Skip to content
OpenAdvisories

Vendor

MBS

26 known vulnerabilities.

Products

UBR-01 Mk II 15 UBR-02 15 UBR-LON 15 Single-A 11 Double-A Profibus 11 Double-A x-link 11 Single-X 11 Double-X CAN 11 Double-X DALI 11 Double-X KNX 11 Double-X LON 11 Double-X M-Bus 11 Double-X PROFINET 11 Double-X x-link 11 Triple-X KNX+DALI 11 Triple-X KNX+LON 11 Triple-X KNX+M-Bus 11 Triple-X PROFINET+DALI 11 Triple-X PROFINET+KNX 11 Triple-X PROFINET+LON 11 Triple-X PROFINET+M-Bus 11
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-35075

    Hardcoded default Password for Service Account

    An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.

    MBS Triple-X KNX+M-Bus Double-X KNX Triple-X PROFINET+KNX
  • Critical 9.1
    CVE-2025-41765

    Unchecked role in wwwupload.cgi

    Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This includes, but is not limited to, contact images, HTTPS certificates, system backups for restoration,…

    MBS UBR-01 Mk II UBR-LON UBR-02
  • Critical 9.1
    CVE-2025-41764

    Unchecked role in wwwupdate.cgi

    Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arbitrary updates.

    MBS UBR-02 UBR-01 Mk II UBR-LON