Which versions of MBS Universal Gateway are affected by CVE-2026-35078?

MBS Universal Gateway (UGW) industrial protocol converters contain a high-severity vulnerability allowing authenticated administrators to delete arbitrary system files; no public exploit identified…

How to fix or mitigate CVE-2026-35078?

Within 24 hours: inventory all MBS UGW devices in production, document firmware versions and model variants, and review administrative access logs for suspicious file deletion activity. Within 7 days: restrict network access to the ugw-logstop function to dedicated management networks via firewall rules, enforce multi-factor authentication on all gateway administrative accounts, and enable comprehensive audit logging. Within 30 days: contact the MBS UGW vendor for patch status and estimated release timeline, implement file integrity monitoring on critical gateway directories, and develop offline backup and recovery procedures for rapid restoration.

MBS Universal Gateway CVE-2026-35078

Q: What is the CVSS score of CVE-2026-35078?

CVE-2026-35078 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34074 HIGH

External Control of File Name or Path (CWE-73)

2026-06-03 CERTVDE

GHSA-2jpx-w8gq-pj3x

Information Disclosure Single A Double A Profibus Double A X Link Single X Double X Can Double X Dali Double X Knx Double X Lon Double X M Bus Double X Profinet Double X X Link Triple X Knx Dali Triple X Knx Lon Triple X Knx M Bus Triple X Profinet Dali Triple X Profinet Knx Triple X Profinet Lon Triple X Profinet M Bus Mbs

7.2

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERTVDE) · only source for this CVE.

CVSS VectorVendor: CERTVDE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 03, 2026 - 13:36 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 03, 2026 - 13:36 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 03, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jun 03, 2026 - 13:22 NVD

8.1 (HIGH) 7.2 (HIGH)

Analysis Generated

Jun 03, 2026 - 12:52 vuln.today

DescriptionCVE.org

The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

AnalysisAI

Arbitrary file deletion in MBS Universal Gateway (UGW) product line allows authenticated remote attackers to delete local files on the device via the ugw-logstop method, which fails to validate user-supplied path input. The flaw affects MBS Single-A, Double-A (Profibus, X-link), Single-X, and Double-X (CAN, DALI, KNX, LON, M-Bus, Profinet) industrial protocol gateways. No public exploit identified at time of analysis, but the low-complexity, low-privilege attack profile makes this a credible threat to availability of industrial control system gateways.

Technical ContextAI

The affected MBS UGW devices are industrial protocol gateways that bridge fieldbus protocols (Profibus, Profinet, KNX, LON, M-Bus, DALI, CAN) used in building automation and industrial control environments. The vulnerability is classified as CWE-73 (External Control of File Name or Path), meaning the ugw-logstop method - likely an administrative function intended to stop log capture and clean up associated files - accepts an attacker-controlled filename or path parameter and passes it to a file deletion operation without canonicalization, allowlist filtering, or path traversal sanitization. CPE data confirms the issue spans the entire MBS UGW product family (cpe:2.3:a:mbs:*), suggesting shared firmware/management code across these gateways.

RemediationAI

Patch status from available data is unclear: no fix version is enumerated in the provided intelligence, so consult the CERT@VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-039/ for the vendor-released patched firmware version for each affected MBS gateway model and apply it as the primary remediation. Until patches are applied, restrict network access to the gateway management interface to a dedicated engineering workstation network segment via firewall ACLs (this is standard ICS hygiene but does require operational coordination since legitimate engineering tools must still reach the device). Enforce strong, unique credentials and remove or disable any low-privilege accounts that do not require gateway access, since the vulnerability requires authenticated user-level credentials (PR:L); rotating credentials and auditing the user list reduces the attacker pool. Monitor the device for unexplained log file disappearance or service failures as a detective control.