Which versions of MBS Gateway Series are affected by CVE-2026-35084?

MBS gateway systems for building automation and industrial control infrastructure are vulnerable to account takeover and complete system compromise.

How to fix or mitigate CVE-2026-35084?

Within 24 hours: Identify and inventory all MBS gateway units (Single-A, Single-X, Double-A/Double-X models) in production and document their role in facility operations. Within 7 days: Restrict creation of new low-privilege user accounts on affected gateways; disable unused accounts; implement network segmentation to isolate gateway management interfaces; enable audit logging for all authentication attempts. Within 30 days: Contact MBS vendor for confirmed patch release date and testing schedule; if patch timeline exceeds 90 days, evaluate replacement systems or implement compensating controls with increased monitoring.

MBS Gateway Series CVE-2026-35084

Q: What is the CVSS score of CVE-2026-35084?

CVE-2026-35084 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34080 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-03 CERTVDE

GHSA-vg85-v4gp-8v33

Buffer Overflow Stack Overflow Single A Double A Profibus Double A X Link Single X Double X Can Double X Dali Double X Knx Double X Lon Double X M Bus Double X Profinet Double X X Link Triple X Knx Dali Triple X Knx Lon Triple X Knx M Bus Triple X Profinet Dali Triple X Profinet Knx Triple X Profinet Lon Triple X Profinet M Bus Mbs

8.7

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERTVDE) · only source for this CVE.

CVSS VectorVendor: CERTVDE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 03, 2026 - 13:30 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 03, 2026 - 13:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 03, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jun 03, 2026 - 13:22 NVD

8.8 (HIGH) 8.7 (HIGH)

Analysis Generated

Jun 03, 2026 - 12:50 vuln.today

DescriptionCVE.org

A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.

AnalysisAI

Privilege escalation to root via stack buffer overflow in dali-devconfig affects MBS gateway products including Single-A, Single-X, and the Double-A/Double-X family (Profibus, X-Link, CAN, DALI, KNX, LON, M-Bus, Profinet). A remote attacker holding low-level user credentials can exploit the flaw to gain full system access, with CVSS 4.0 scoring it 8.7 (High). No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) and resides in dali-devconfig, a configuration utility tied to the DALI lighting/automation interface exposed by the MBS gateway line. The affected CPEs cover MBS protocol gateways used to bridge fieldbus and building-automation networks (Profibus, Profinet, KNX, LON, M-Bus, CAN, DALI, X-Link). Stack overflows in such embedded fieldbus gateways typically arise from unbounded copies of attacker-controlled configuration strings into fixed-size stack buffers, enabling control-flow hijack once the saved return address or adjacent stack data is overwritten. Because dali-devconfig appears to execute with elevated privileges, exploitation yields root on the gateway operating system.

RemediationAI

Patch availability is not explicitly stated in the provided data; consult the CERT@VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-039/ for the vendor-released fixed firmware version for each MBS Single-A, Single-X, Double-A, and Double-X model and upgrade to that build. Until patched firmware can be deployed, compensating controls should focus on the PR:L prerequisite: restrict network reachability of the gateway management/configuration interface to a dedicated engineering VLAN or jump host so dali-devconfig is not reachable from operator or IT networks (side effect: remote configuration workflows must transit the jump host), rotate any shared or default low-privilege gateway accounts and enforce unique strong credentials per operator (side effect: operational overhead), and monitor authentication and configuration activity on the gateway for anomalous dali-devconfig invocations. Disabling the DALI configuration service entirely is only viable on gateways where DALI functionality is unused.