EUVD-2026-34078
GHSA-v475-jf39-hvf2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (CERTVDE) · only source for this CVE.
CVSS VectorVendor: CERTVDE
Lifecycle Timeline
5DescriptionCVE.org
The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.
AnalysisAI
Path traversal in MBS industrial gateway products (Single-A, Double-A, Single-X, Double-X series) allows authenticated remote attackers to read arbitrary files on the device via the ugw-logread method. CVSS 4.0 score of 8.7 reflects network-reachable exploitation with only low-privilege user credentials needed, exposing potentially sensitive configuration, credential, and operational data on industrial protocol gateways. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
The affected MBS product line consists of protocol gateways that bridge fieldbus and building-automation networks (Profibus, Profinet, CAN, KNX, DALI, LON, M-Bus, X-Link) to higher-level IP networks, commonly deployed in industrial control and building-management environments. The flaw resides in the ugw-logread method, a log-retrieval interface in the MBS UGW (Universal Gateway) firmware that fails to sanitize user-supplied path input. This is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) issue, where path components such as '../' traversal sequences allow the application to resolve and return files outside the intended log directory.
RemediationAI
No vendor-released patch identified at time of analysis from the provided input; consult the CERT@VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-039/ for the authoritative fixed firmware versions for each MBS gateway model and apply the vendor-supplied firmware update once available. As compensating controls until patched, restrict network access to the gateway management/web interface to a dedicated management VLAN or jump host (this may complicate legitimate remote administration), rotate and enforce strong unique credentials on all gateway user accounts to raise the bar on the PR:L prerequisite, disable or remove unused low-privilege user accounts that could be leveraged for the ugw-logread call, and monitor gateway access logs for unusual log-read requests or path patterns containing traversal sequences.
Credential disclosure in MBS industrial protocol gateways (Single-A, Double-A, Single-X, and Double-X product families)
Privilege escalation to root in MBS Single-A, Double-A, Single-X, and Double-X industrial gateway product lines allows a
Privilege escalation to root via stack buffer overflow in dali-devconfig affects MBS gateway products including Single-A
Privilege escalation to root in MBS industrial protocol gateways (Single-A, Double-A, Single-X, Double-X product lines c
Arbitrary file deletion in MBS GmbH universal gateway (UGW) products allows authenticated remote users to remove files o
Arbitrary file deletion in MBS Universal Gateway (UGW) products allows authenticated remote attackers with low-privilege
Arbitrary file deletion in MBS Universal Gateway (UGW) product line allows authenticated remote attackers to delete loca
Arbitrary file deletion in MBS Universal Gateway (UGW) product family allows authenticated remote attackers to remove an
Arbitrary file deletion in MBS GmbH industrial gateway products (single-a, double-a, single-x, double-x variants across
Privilege escalation / denial of service in MBS Universal Gateway (UGW) product family allows an authenticated low-privi
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today