Skip to main content

MBS Gateways CVE-2026-35082

| EUVDEUVD-2026-34078 HIGH
Path Traversal (CWE-22)
2026-06-03 CERTVDE GHSA-v475-jf39-hvf2
Path Traversal Single A Double A Profibus Double A X Link Single X Double X Can Double X Dali Double X Knx Double X Lon Double X M Bus Double X Profinet Double X X Link Triple X Knx Dali Triple X Knx Lon Triple X Knx M Bus Triple X Profinet Dali Triple X Profinet Knx Triple X Profinet Lon Triple X Profinet M Bus
8.7
CVSS 4.0 · Vendor: CERTVDE
Share

Severity by source

Vendor (CERTVDE) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERTVDE) · only source for this CVE.

CVSS VectorVendor: CERTVDE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
Analysis Updated
Jun 03, 2026 - 13:32 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 03, 2026 - 13:32 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 03, 2026 - 13:22 vuln.today
cvss_changed
CVSS changed
Jun 03, 2026 - 13:22 NVD
8.8 (HIGH) 8.7 (HIGH)
Analysis Generated
Jun 03, 2026 - 12:51 vuln.today

DescriptionCVE.org

The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.

AnalysisAI

Path traversal in MBS industrial gateway products (Single-A, Double-A, Single-X, Double-X series) allows authenticated remote attackers to read arbitrary files on the device via the ugw-logread method. CVSS 4.0 score of 8.7 reflects network-reachable exploitation with only low-privilege user credentials needed, exposing potentially sensitive configuration, credential, and operational data on industrial protocol gateways. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach gateway management interface
Delivery
Authenticate with low-privilege user account
Exploit
Invoke ugw-logread with traversal path
Execution
Read arbitrary files outside log directory
Persist
Harvest credentials and configuration
Impact
Pivot deeper into OT network
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires (1) network reachability to the MBS gateway's management interface that exposes the ugw-logread method, and (2) a valid low-privilege user-level credential on the device (CVSS PR:L) - anonymous/unauthenticated access is not indicated. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring only a low-privilege user account and no user interaction, with high impact across confidentiality, integrity, and availability of the vulnerable component, justifying the 8.7 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained or been granted a low-privilege user account on an MBS gateway - for example via reused default credentials, a phished operator login, or an insider - connects to the device over the network and invokes the ugw-logread method with a crafted path argument that escapes the log directory, retrieving files such as configuration backups, stored credentials, certificates, or other sensitive data outside the intended scope. No public exploit identified at time of analysis, but the path-traversal pattern is trivial to weaponize once the request format is known.
Remediation No vendor-released patch identified at time of analysis from the provided input; consult the CERT@VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-039/ for the authoritative fixed firmware versions for each MBS gateway model and apply the vendor-supplied firmware update once available. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all MBS industrial gateways (Single-A, Double-A, Single-X, Double-X series) in production and audit low-privilege account creation over the past 90 days. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Single A

View all
CVE-2026-35075 CRITICAL
9.3 Jun 03

Credential disclosure in MBS industrial protocol gateways (Single-A, Double-A, Single-X, and Double-X product families)

CVE-2026-35085 HIGH
8.7 Jun 03

Privilege escalation to root in MBS Single-A, Double-A, Single-X, and Double-X industrial gateway product lines allows a
CVE-2026-35084 HIGH
8.7 Jun 03

Privilege escalation to root via stack buffer overflow in dali-devconfig affects MBS gateway products including Single-A
CVE-2026-35083 HIGH
8.7 Jun 03

Privilege escalation to root in MBS industrial protocol gateways (Single-A, Double-A, Single-X, Double-X product lines c
CVE-2026-35080 HIGH
7.2 Jun 03

Arbitrary file deletion in MBS GmbH universal gateway (UGW) products allows authenticated remote users to remove files o
CVE-2026-35079 HIGH
7.2 Jun 03

Arbitrary file deletion in MBS Universal Gateway (UGW) products allows authenticated remote attackers with low-privilege
CVE-2026-35078 HIGH
7.2 Jun 03

Arbitrary file deletion in MBS Universal Gateway (UGW) product line allows authenticated remote attackers to delete loca
CVE-2026-35077 HIGH
7.2 Jun 03

Arbitrary file deletion in MBS Universal Gateway (UGW) product family allows authenticated remote attackers to remove an
CVE-2026-35076 HIGH
7.2 Jun 03

Arbitrary file deletion in MBS GmbH industrial gateway products (single-a, double-a, single-x, double-x variants across

CVE-2026-35081 HIGH
7.2 Jun 03

Privilege escalation / denial of service in MBS Universal Gateway (UGW) product family allows an authenticated low-privi

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2024-57727 HIGH POC
7.5

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6
CVE-2024-57727 HIGH POC
7.5
CVE-2024-7399 HIGH POC
8.8
CVE-2024-27199 HIGH POC
7.3

Share

CVE-2026-35082 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy