Which versions of MBS Universal Gateway are affected by CVE-2026-35077?

A file deletion vulnerability in MBS Universal Gateway (CVE-2026-35077) permits low-privileged authenticated users to remove arbitrary files, directly compromising system integrity and availability…

How to fix or mitigate CVE-2026-35077?

Within 24 hours: identify all UGW deployments in your environment and audit account privileges; implement network segmentation to restrict access to ugw-delete-file method. Within 7 days: enforce multi-factor authentication for all UGW accounts; apply principle of least privilege to service accounts and reduce the number of users with delete permissions. Within 30 days: monitor MBS vendor advisories for patch release; enable audit logging of all file operations; implement file integrity monitoring on UGW instances; establish and test backup recovery procedures for rapid incident response.

MBS Universal Gateway CVE-2026-35077

Q: What is the CVSS score of CVE-2026-35077?

CVE-2026-35077 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34073 HIGH

External Control of File Name or Path (CWE-73)

2026-06-03 CERTVDE

GHSA-c9gv-mp37-24rp

Information Disclosure Single A Double A Profibus Double A X Link Single X Double X Can Double X Dali Double X Knx Double X Lon Double X M Bus Double X Profinet Double X X Link Triple X Knx Dali Triple X Knx Lon Triple X Knx M Bus Triple X Profinet Dali Triple X Profinet Knx Triple X Profinet Lon Triple X Profinet M Bus Mbs

7.2

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERTVDE) · only source for this CVE.

CVSS VectorVendor: CERTVDE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 03, 2026 - 13:37 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 03, 2026 - 13:37 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 03, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jun 03, 2026 - 13:22 NVD

8.1 (HIGH) 7.2 (HIGH)

Analysis Generated

Jun 03, 2026 - 12:53 vuln.today

DescriptionCVE.org

The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

AnalysisAI

Arbitrary file deletion in MBS Universal Gateway (UGW) product family allows authenticated remote attackers to remove any file on the device filesystem by abusing the ugw-delete-file method, which fails to validate user-controlled path input (CWE-73). With CVSS 4.0 score 7.2 and PR:L, exploitation requires only a low-privileged account, and successful abuse impacts integrity and availability of the gateway (VI:H/VA:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

MBS GmbH manufactures protocol-converter gateways used in building automation and industrial networks - the affected line covers Single-A, Double-A Profibus, Double-A X-Link, Single-X, and Double-X variants for CAN, DALI, KNX, LON, M-Bus and Profinet field buses. The ugw-delete-file method is an administrative/maintenance routine exposed by the gateway's management interface (UGW = Universal Gateway). CWE-73 (External Control of File Name or Path) is the root cause: the handler accepts a file path from the request and passes it to a filesystem delete operation without canonicalising it, restricting it to a safe directory, or rejecting traversal sequences, so any reachable path on the device can be supplied.

RemediationAI

No vendor-released patched firmware version was supplied in the available data; consult VDE advisory VDE-2026-039 at https://www.certvde.com/en/advisories/VDE-2026-039/ for the authoritative fixed firmware versions per MBS gateway model and upgrade affected Single-A, Double-A, Single-X and Double-X devices accordingly. Until a fix can be deployed, compensating controls should focus on the precondition PR:L: revoke or rotate credentials for any non-essential UGW user accounts, restrict the gateway management interface to a dedicated engineering VLAN or jump host via firewall rules, and disable remote/internet exposure of the gateway entirely - the trade-off is that legitimate remote maintenance workflows will break and on-site or VPN access will be required. Add monitoring/alerting on the gateway's filesystem and on use of the ugw-delete-file endpoint so that any abuse from a compromised low-privilege account is detected quickly.