EUVD-2026-34071
GHSA-fhf4-qwrf-f48v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (CERTVDE) · only source for this CVE.
CVSS VectorVendor: CERTVDE
Lifecycle Timeline
5DescriptionCVE.org
An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
AnalysisAI
Credential disclosure in MBS industrial protocol gateways (Single-A, Double-A, Single-X, and Double-X product families) allows remote unauthenticated attackers to extract a hard-coded default password embedded in the firmware image and use it to obtain full administrative control of any affected device. With a CVSS 4.0 score of 9.3 and the vulnerability reported through CERT@VDE under advisory VDE-2026-039, the issue is severe because the recovered credential is shared across the device line, but at the time of analysis there is no public exploit identified and the vulnerability is not listed in CISA KEV.
Technical ContextAI
MBS GmbH manufactures industrial protocol converter and gateway appliances used to bridge fieldbus and building-automation networks such as Profibus, Profinet, KNX, DALI, LON, M-Bus, and CAN to IP networks; the affected CPEs (mbs:single-a, mbs:double-a_profibus, mbs:double-a_x-link, mbs:single-x, mbs:double-x_can/dali/knx/lon/m-bus/profinet) cover essentially the entire Single-A/Double-A and Single-X/Double-X gateway line. The root cause is CWE-1393 (Use of Default Password): a static credential is compiled into or stored within the shipped firmware image, so anyone who can obtain that firmware (vendor download, device extraction, or a captured update file) can recover the password through static analysis and then reuse it against any internet- or network-reachable unit. Because the credential is shared across devices rather than derived per-unit, a single firmware analysis effort yields a master key for the entire fleet.
RemediationAI
Patch status is not explicitly confirmed in the provided data - refer to the CERT@VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-039/ for the vendor-released firmware version and apply it to every affected Single-A, Double-A, Single-X, and Double-X gateway as soon as it is published. Because the credential is shared and recoverable from firmware, a firmware update that merely changes the password is insufficient unless it also enforces a unique per-device or operator-set credential at first boot, so verify the patch behavior before assuming closure. Until the vendor-released patch is deployed, restrict network reachability of the gateway management interface to a dedicated OT management VLAN, block management ports at perimeter and OT/IT boundary firewalls, place the devices behind a jump host with strong authentication, and monitor authentication events for use of the default account - note that ACL-based mitigations do not remove the credential and will fail open if an attacker reaches the management plane through any path (USB, supply-chain firmware, or lateral movement from an adjacent compromised host).
Path traversal in MBS industrial gateway products (Single-A, Double-A, Single-X, Double-X series) allows authenticated r
Privilege escalation to root in MBS Single-A, Double-A, Single-X, and Double-X industrial gateway product lines allows a
Privilege escalation to root via stack buffer overflow in dali-devconfig affects MBS gateway products including Single-A
Privilege escalation to root in MBS industrial protocol gateways (Single-A, Double-A, Single-X, Double-X product lines c
Arbitrary file deletion in MBS GmbH universal gateway (UGW) products allows authenticated remote users to remove files o
Arbitrary file deletion in MBS Universal Gateway (UGW) products allows authenticated remote attackers with low-privilege
Arbitrary file deletion in MBS Universal Gateway (UGW) product line allows authenticated remote attackers to delete loca
Arbitrary file deletion in MBS Universal Gateway (UGW) product family allows authenticated remote attackers to remove an
Arbitrary file deletion in MBS GmbH industrial gateway products (single-a, double-a, single-x, double-x variants across
Privilege escalation / denial of service in MBS Universal Gateway (UGW) product family allows an authenticated low-privi
Same weakness CWE-1393 – Use of Default Password
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today