Which versions of MBS Universal Gateway are affected by CVE-2026-35079?

MBS Universal Gateway (UGW) products contain an arbitrary file deletion vulnerability affecting authenticated low-privilege users, impacting industrial fieldbus gateways across multiple variants used…

How to fix or mitigate CVE-2026-35079?

24 hours: Audit all MBS UGW deployments to identify affected models (Single-A, Double-A Profibus/X-Link, Single-X, Double-X CAN/DALI/KNX/LON/M-Bus/Profinet) and document installed firmware versions. 7 days: Restrict network access to UGW management interfaces via firewall rules; disable the ugw-restore method if operationally feasible. 30 days: Establish vendor contact for patch availability timeline; implement mandatory administrative approval workflow for any restore operations; deploy file integrity monitoring on UGW systems.

MBS Universal Gateway CVE-2026-35079

Q: What is the CVSS score of CVE-2026-35079?

CVE-2026-35079 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34075 HIGH

External Control of File Name or Path (CWE-73)

2026-06-03 CERTVDE

GHSA-9rf2-8ppr-jwp6

Information Disclosure Single A Double A Profibus Double A X Link Single X Double X Can Double X Dali Double X Knx Double X Lon Double X M Bus Double X Profinet Double X X Link Triple X Knx Dali Triple X Knx Lon Triple X Knx M Bus Triple X Profinet Dali Triple X Profinet Knx Triple X Profinet Lon Triple X Profinet M Bus Mbs

7.2

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERTVDE) · only source for this CVE.

CVSS VectorVendor: CERTVDE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 03, 2026 - 13:35 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 03, 2026 - 13:35 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 03, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jun 03, 2026 - 13:22 NVD

8.1 (HIGH) 7.2 (HIGH)

Analysis Generated

Jun 03, 2026 - 12:52 vuln.today

DescriptionCVE.org

The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

AnalysisAI

Arbitrary file deletion in MBS Universal Gateway (UGW) products allows authenticated remote attackers with low-privilege user accounts to delete arbitrary files on the device by abusing the ugw-restore method, which fails to validate user-controlled path input. The vulnerability affects multiple MBS gateway variants (Single-A, Double-A Profibus/X-Link, Single-X, and Double-X CAN/DALI/KNX/LON/M-Bus/Profinet bridges) used in industrial fieldbus integration. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

MBS Universal Gateways are industrial protocol converters that bridge fieldbus systems (Profibus, Profinet, KNX, LON, DALI, M-Bus, CAN) to IP-based networks for building automation and OT integration. The ugw-restore method appears to be part of the device's backup/restore configuration interface; it accepts user-supplied input that resolves to a filesystem path. The root cause maps to CWE-73 (External Control of File Name or Path), meaning the attacker can influence the path argument passed to a file operation without canonicalization or allow-list enforcement, enabling directory traversal into sensitive locations outside the intended restore scope.

RemediationAI

Patch status is not enumerated in the supplied data - no vendor-released patched version is independently confirmed at time of analysis, so administrators must consult the CERT@VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-039/ for the fixed firmware revision and apply it to each affected MBS gateway model in inventory. As compensating controls until patches are applied, restrict network access to the gateway's management/web interface to a dedicated OT management VLAN or jump host (this is appropriate for ICS gateways which should not be broadly reachable), rotate and minimize user accounts on the device so that only a small set of operators hold authenticated access that can reach the ugw-restore endpoint, and enable configuration backups stored off-device so that a successful file-deletion attack can be recovered from quickly. Note that network restriction may break legitimate remote engineering workflows and should be coordinated with the controls team.