High · 8.1 CVE-2026-35080 EUVD-2026-34076GHSA-vhmf-2j3g-8p9g

Arbitrary file delete vulnerability in method ugw-restoreinfo

Published Jun 3, 2026 · Updated Jul 3, 2026 · Assigned by CERTVDE

Vendor: MBS Product: Double-A Profibus Product: Double-A x-link Product: Double-X CAN Product: Double-X DALI Product: Double-X KNX Product: Double-X LON Product: Double-X M-Bus Product: Double-X PROFINET Product: Double-X x-link Product: Single-A Product: Single-X Product: Triple-X KNX+DALI Product: Triple-X KNX+LON Product: Triple-X KNX+M-Bus Product: Triple-X PROFINET+DALI Product: Triple-X PROFINET+KNX Product: Triple-X PROFINET+LON Product: Triple-X PROFINET+M-Bus

Description

The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

Affected products

Vendor	Product	Affected	Fixed
MBS	Single-A	V1_00_00 – < V6_00_07	V6_00_07
MBS	Double-A Profibus	V1_00_00 – < V6_00_07	V6_00_07
MBS	Double-A x-link	V1_00_00 – < V6_00_07	V6_00_07
MBS	Single-X	V1_00_00 – < V6_00_07	V6_00_07
MBS	Double-X CAN	V1_00_00 – < V6_00_07	V6_00_07
MBS	Double-X DALI	V1_00_00 – < V6_00_07	V6_00_07
MBS	Double-X KNX	V1_00_00 – < V6_00_07	V6_00_07
MBS	Double-X LON	V1_00_00 – < V6_00_07	V6_00_07
MBS	Double-X M-Bus	V1_00_00 – < V6_00_07	V6_00_07
MBS	Double-X PROFINET	V1_00_00 – < V6_00_07	V6_00_07
MBS	Double-X x-link	V1_00_00 – < V6_00_07	V6_00_07
MBS	Triple-X KNX+DALI	V1_00_00 – < V6_00_07	V6_00_07
MBS	Triple-X KNX+LON	V1_00_00 – < V6_00_07	V6_00_07
MBS	Triple-X KNX+M-Bus	V1_00_00 – < V6_00_07	V6_00_07
MBS	Triple-X PROFINET+DALI	V1_00_00 – < V6_00_07	V6_00_07
MBS	Triple-X PROFINET+KNX	V1_00_00 – < V6_00_07	V6_00_07
MBS	Triple-X PROFINET+LON	V1_00_00 – < V6_00_07	V6_00_07
MBS	Triple-X PROFINET+M-Bus	V1_00_00 – < V6_00_07	V6_00_07

Advisories 1

VDE-2026-039 MBS: Several security vulnerabilities in the UGW web GUI CERT@VDE · Jul 3, 2026

References

https://www.certvde.com/en/advisories/VDE-2026-039/