Which versions of MBS Universal Gateway are affected by CVE-2026-35081?

MBS Universal Gateway (UGW) industrial automation gateways contain an unpatched privilege escalation vulnerability (CVE-2026-35081, CVSS 7.2) affecting Single-A, Double-A, Single-X, and Double-X…

How to fix or mitigate CVE-2026-35081?

Within 24 hours: Identify and inventory all MBS UGW deployments and document user access controls for low-privilege accounts. Within 7 days: Restrict network access to UGW systems using zero-trust segmentation; disable or enforce strict controls on low-privilege remote authentication; enable process-level logging and alerting for unauthorized terminations. Within 30 days: Monitor MBS security advisories for patch release; evaluate upgrade to patched versions when available; implement network-level controls to restrict access to essential users only.

MBS Universal Gateway CVE-2026-35081

Q: What is the CVSS score of CVE-2026-35081?

CVE-2026-35081 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34077 HIGH

Improper Input Validation (CWE-20)

2026-06-03 CERTVDE

GHSA-vwg2-pp87-3x79

Information Disclosure Single A Double A Profibus Double A X Link Single X Double X Can Double X Dali Double X Knx Double X Lon Double X M Bus Double X Profinet Double X X Link Triple X Knx Dali Triple X Knx Lon Triple X Knx M Bus Triple X Profinet Dali Triple X Profinet Knx Triple X Profinet Lon Triple X Profinet M Bus Mbs

7.2

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERTVDE) · only source for this CVE.

CVSS VectorVendor: CERTVDE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 03, 2026 - 13:33 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 03, 2026 - 13:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 03, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jun 03, 2026 - 13:22 NVD

8.1 (HIGH) 7.2 (HIGH)

Analysis Generated

Jun 03, 2026 - 12:51 vuln.today

DescriptionCVE.org

The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.

AnalysisAI

Privilege escalation / denial of service in MBS Universal Gateway (UGW) product family allows an authenticated low-privileged remote user to terminate arbitrary processes on the device via the ugw-logstop method, which fails to validate user-supplied input. No public exploit identified at time of analysis, but the bug affects a broad set of MBS industrial protocol gateways (Single-A, Double-A Profibus/X-Link, Single-X, Double-X CAN/DALI/KNX/LON/M-Bus/Profinet) used in building and industrial automation. CVSS 4.0 base is 7.2 reflecting High integrity and availability impact with only low privileges required.

Technical ContextAI

The MBS Universal Gateway (UGW) is a family of industrial protocol gateways that bridge fieldbus protocols (Profibus, Profinet, KNX, DALI, LON, M-Bus, CAN) into IP-based networks for building and process automation. The vulnerable component is an internal management method named 'ugw-logstop', exposed over the gateway's network management interface. The root cause is CWE-20 (Improper Input Validation): the method accepts a parameter (most likely a process or service identifier) and acts on it without verifying that the caller is permitted to operate on that target, allowing the caller to direct the gateway to terminate processes other than its own logging service. Because UGW devices typically run critical protocol-translation daemons that bridge OT traffic, killing those processes degrades or halts the fieldbus communication the device exists to provide.

RemediationAI

No vendor-released patch version was identified at time of analysis from the supplied data; consult MBS via the CERT@VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-039/ for the fixed firmware build and apply it to all listed Single-A, Single-X, Double-A and Double-X gateways. Until a patched firmware is deployed, the most effective compensating control is to restrict network access to the gateway's management interface to a dedicated jump host or engineering VLAN so that only a minimal, audited set of operators can reach the ugw-logstop endpoint (trade-off: emergency remote troubleshooting becomes slower and may require an out-of-band path). Additionally, rotate and tighten the credentials of every low-privilege UGW account, removing any shared or default user-tier logins, since the bug only requires PR:L to exploit (trade-off: integrators who relied on shared service accounts will need per-user credentials). Finally, monitor the gateway for unexplained process restarts or fieldbus session drops as a detection proxy until firmware can be applied.