An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NMbs Solutions Ubr 01 Mk Ii
HWMbs-Solutionswszystkie wersjeMbs Solutions Ubr 02
HWMbs-Solutionswszystkie wersjeMbs Solutions Ubr Lon
HWMbs-Solutionswszystkie wersjeMbs Solutions Universal Bacnet Router Firmware
OSMbs-Solutions< 6.0.1.0
π΅
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References
Related vulnerabilities
CVE-2025-41765CRITICAL9.1PL βten sam produkt
Brak autoryzacji w MBS-Solutions Universal BACnet Router β nieautoryzowany upload plikΓ³w
CVE-2025-41764CRITICAL9.1PL βten sam produkt
Brak autoryzacji w MBS-Solutions Universal BACnet Router β upload firmware
CVE-2025-41756HIGH8.1ten sam produkt
A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused...
CVE-2025-41758HIGH8.8ten sam produkt
A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoin...
CVE-2025-41757HIGH8.8ten sam produkt
A low-privileged remote attacker can abuse the backup restore functionality of UBR (ubr-restore) which runs wi...