EUVD-2026-34079
GHSA-qjjc-764q-w65v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (CERTVDE) · only source for this CVE.
CVSS VectorVendor: CERTVDE
Lifecycle Timeline
5DescriptionCVE.org
A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.
AnalysisAI
Privilege escalation to root in MBS industrial protocol gateways (Single-A, Double-A, Single-X, Double-X product lines covering Profibus, Profinet, KNX, DALI, LON, M-Bus, CAN, and X-Link variants) is achievable by an authenticated remote user via a stack buffer overflow. The CVSS 4.0 base score of 8.7 reflects network-reachable exploitation with low complexity and only user-level privileges required, leading to full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the issue was coordinated through CERT@VDE (advisory VDE-2026-039), indicating responsible disclosure rather than in-the-wild abuse.
Technical ContextAI
The affected devices are MBS fieldbus/protocol gateway appliances used in industrial and building automation networks to bridge between TCP/IP and legacy fieldbus protocols (Profibus, Profinet, KNX, DALI, LON, M-Bus, CAN). CWE-121 (Stack-based Buffer Overflow) indicates that input handling on the device writes attacker-controlled data past the bounds of a fixed-size stack buffer, allowing corruption of the saved return address, frame pointer, or adjacent local variables. Because gateway firmware in this device class typically runs services as root without modern mitigations such as full ASLR or stack canaries, successful overflow exploitation cleanly converts into arbitrary code execution at the highest privilege level on the device. CPE strings confirm the affected variants span the entire Single-A/Double-A and Single-X/Double-X product families across multiple bus technologies, strongly implying a shared codebase or common service component.
RemediationAI
Consult the CERT@VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-039/ for the vendor-supplied firmware update covering the affected Single-A, Double-A, Single-X, and Double-X gateways; specific fixed firmware versions were not included in the available data, so patch status here is recorded as patch available per vendor advisory pending version confirmation. Until firmware can be applied, restrict network reachability of the gateway management/data interfaces to a dedicated engineering VLAN or jump host (this will block remote exploitation but breaks any remote engineering workflows that currently rely on direct access), disable or remove unused gateway user accounts and rotate credentials for remaining ones to raise the bar on the PR:L prerequisite, and enable network-layer monitoring for anomalous oversized payloads or repeated connection resets to the gateway services. Avoid exposing these devices to corporate IT networks or the internet under any circumstance.
Credential disclosure in MBS industrial protocol gateways (Single-A, Double-A, Single-X, and Double-X product families)
Path traversal in MBS industrial gateway products (Single-A, Double-A, Single-X, Double-X series) allows authenticated r
Privilege escalation to root in MBS Single-A, Double-A, Single-X, and Double-X industrial gateway product lines allows a
Privilege escalation to root via stack buffer overflow in dali-devconfig affects MBS gateway products including Single-A
Arbitrary file deletion in MBS GmbH universal gateway (UGW) products allows authenticated remote users to remove files o
Arbitrary file deletion in MBS Universal Gateway (UGW) products allows authenticated remote attackers with low-privilege
Arbitrary file deletion in MBS Universal Gateway (UGW) product line allows authenticated remote attackers to delete loca
Arbitrary file deletion in MBS Universal Gateway (UGW) product family allows authenticated remote attackers to remove an
Arbitrary file deletion in MBS GmbH industrial gateway products (single-a, double-a, single-x, double-x variants across
Privilege escalation / denial of service in MBS Universal Gateway (UGW) product family allows an authenticated low-privi
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today