How to fix CVE-2025-41767?

Within 24 hours: Inventory all Universal BACnet Router deployments and assess their network exposure. Within 7 days: Implement network segmentation to isolate affected BACnet routers from untrusted networks and restrict administrative access to authorized personnel only. Within 30 days: Monitor vendor communications for patch availability and establish a staged deployment plan; coordinate with building automation or OT teams to schedule updates during maintenance windows.

Is Universal Bacnet Router Firmware affected by CVE-2025-41767?

CVE-2025-41767 affects Universal BACnet Router firmware and allows attackers to bypass cryptographic signature verification, potentially enabling unauthorized firmware modifications or device compromise.

CVE-2025-41767

HIGH

2026-03-09 [email protected]

7.2

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Mar 09, 2026 - 09:16 nvd

HIGH 7.2

Description

A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi method in the web interface of UBR.

Analysis

Universal Bacnet Router Firmware is affected by improper verification of cryptographic signature (CVSS 7.2).

Technical Context

This vulnerability (CWE-347: Improper Verification of Cryptographic Signature) exists in the wwwupdate.cgi method in the web component. A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi method in the web interface of UBR.

Affected Products

Vendor: Mbs-Solutions. Product: Universal Bacnet Router Firmware. Component: wwwupdate.cgi method in the web.

Remediation

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.1

CVSS: +36

POC: 0

CVE-2025-41767 vulnerability details – vuln.today

Back

CVE-2025-41767

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2025-41767

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code