« Back to list

CVE-2025-41764

Status: AnalyzedCritical (9.1)—

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arbitrary updates.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector CVSS AV:N/AC:L/PR:N/UI:N indica acceso remoto sin autenticación. CWE-862 (autorización insuficiente) en endpoint wwwupdate.cgi permite carga de actualizaciones arbitrarias, resultando en modificación de firmware y potencial escalada de privilegios en el dispositivo.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Application Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability ScanningThreat Intelligence ProgramPrivileged Account Management

Affected technologies (1)

Mbs-solutions — Universal Bacnet Router Firmware

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2025-41764",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-41764",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-09T20:03:13.228044Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "MBS",
          "product": "UBR-01 Mk II",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "6.0.1.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "MBS",
          "product": "UBR-02",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "6.0.1.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "MBS",
          "product": "UBR-LON",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "6.0.1.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-09T09:16:00.807",
  "references": [
    {
      "url": "https://www.mbs-solutions.de/mbs-2025-0001",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "info@cert.vde.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arbitrary updates."
    },
    {
      "lang": "es",
      "value": "Debido a una aplicación insuficiente de la autorización, un atacante remoto no autorizado puede explotar el endpoint wwwupdate.cgi para cargar y aplicar actualizaciones arbitrarias."
    }
  ],
  "lastModified": "2026-06-17T09:23:07.847",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:mbs-solutions:universal_bacnet_router_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4E2B246-5465-41DB-BD9A-1533A7508790",
              "versionEndExcluding": "6.0.1.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:mbs-solutions:ubr-01_mk_ii:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0D812069-6738-4B82-992B-09BB239783AB"
            },
            {
              "criteria": "cpe:2.3:h:mbs-solutions:ubr-02:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B21413DE-E1FA-4B5C-A415-F8E70D7090BF"
            },
            {
              "criteria": "cpe:2.3:h:mbs-solutions:ubr-lon:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E0C67EAC-C633-4037-B2C4-965455FFF2A0"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com"
}