EUVD-2026-34076
GHSA-vhmf-2j3g-8p9g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (CERTVDE) · only source for this CVE.
CVSS VectorVendor: CERTVDE
Lifecycle Timeline
5DescriptionCVE.org
The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
AnalysisAI
Arbitrary file deletion in MBS GmbH universal gateway (UGW) products allows authenticated remote users to remove files on the device through the ugw-restoreinfo method, which fails to validate user-controlled path input (CWE-73). The flaw, reported by CERT@VDE and tracked under VDE-2026-039, affects the Single-A, Double-A (Profibus/X-Link), Single-X, and Double-X (CAN/DALI/KNX/LON/M-Bus/Profinet) fieldbus gateway product lines used in industrial and building automation. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
MBS GmbH gateways act as protocol converters between IP networks and industrial fieldbus protocols (Profibus, Profinet, KNX, LON, DALI, M-Bus, CAN). The UGW management interface exposes a ugw-restoreinfo method intended for restoring backup/configuration data; the root cause is CWE-73 (External Control of File Name or Path), meaning the handler accepts a file path or name from the authenticated client and acts on it without sufficient canonicalization or allow-listing. As a result, supplied paths can traverse outside the intended restore directory and target arbitrary files accessible to the gateway process, leading to deletion rather than the intended restore operation.
RemediationAI
No vendor-released patch version is identified in the available data; consult the CERT@VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-039/ and the MBS GmbH support channel for the fixed firmware build for each affected gateway line. As compensating controls until the firmware fix is deployed, restrict network reachability of the UGW management interface to a dedicated engineering VLAN or jump-host (this breaks any remote operator workflows that depend on direct access), disable or rotate any low-privilege gateway user accounts that are not strictly required so the PR:L precondition cannot be met from general OT users, and monitor the gateway file system or configuration backups for unexpected deletions so an attempted exploit is detected even if it succeeds. Avoid exposing these gateways to the corporate IT network or the internet under any circumstances.
Credential disclosure in MBS industrial protocol gateways (Single-A, Double-A, Single-X, and Double-X product families)
Path traversal in MBS industrial gateway products (Single-A, Double-A, Single-X, Double-X series) allows authenticated r
Privilege escalation to root in MBS Single-A, Double-A, Single-X, and Double-X industrial gateway product lines allows a
Privilege escalation to root via stack buffer overflow in dali-devconfig affects MBS gateway products including Single-A
Privilege escalation to root in MBS industrial protocol gateways (Single-A, Double-A, Single-X, Double-X product lines c
Arbitrary file deletion in MBS Universal Gateway (UGW) products allows authenticated remote attackers with low-privilege
Arbitrary file deletion in MBS Universal Gateway (UGW) product line allows authenticated remote attackers to delete loca
Arbitrary file deletion in MBS Universal Gateway (UGW) product family allows authenticated remote attackers to remove an
Arbitrary file deletion in MBS GmbH industrial gateway products (single-a, double-a, single-x, double-x variants across
Privilege escalation / denial of service in MBS Universal Gateway (UGW) product family allows an authenticated low-privi
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today