Which versions of MBS Gateways are affected by CVE-2026-35085?

MBS industrial gateway product lines (Single-A, Double-A, Single-X, Double-X) contain an unpatched privilege escalation vulnerability (CVE-2026-35085, CVSS 8.7) permitting authenticated remote…

How to fix or mitigate CVE-2026-35085?

Within 24 hours: Complete inventory of all affected MBS gateway models and versions in your operational technology environment; segment network access to these appliances and document current remote-access exposure. Within 7 days: Implement network-level restrictions limiting remote connections to trusted administrative networks only; establish multi-factor authentication for any remote administrative access; contact vendor for patch timeline and formal workaround documentation. Within 30 days: Deploy enhanced monitoring and alerting for unauthorized privilege escalation attempts; complete operational impact assessment and develop staged remediation timeline.

MBS Gateways CVE-2026-35085

Q: What is the CVSS score of CVE-2026-35085?

CVE-2026-35085 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34081 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-03 CERTVDE

GHSA-57rp-874r-xvf4

Buffer Overflow Stack Overflow Single A Double A Profibus Double A X Link Single X Double X Can Double X Dali Double X Knx Double X Lon Double X M Bus Double X Profinet Double X X Link Triple X Knx Dali Triple X Knx Lon Triple X Knx M Bus Triple X Profinet Dali Triple X Profinet Knx Triple X Profinet Lon Triple X Profinet M Bus Mbs

8.7

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERTVDE) · only source for this CVE.

CVSS VectorVendor: CERTVDE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 03, 2026 - 13:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 03, 2026 - 13:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 03, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jun 03, 2026 - 13:22 NVD

8.8 (HIGH) 8.7 (HIGH)

Analysis Generated

Jun 03, 2026 - 12:50 vuln.today

DescriptionCVE.org

A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.

AnalysisAI

Privilege escalation to root in MBS Single-A, Double-A, Single-X, and Double-X industrial gateway product lines allows authenticated remote attackers to corrupt stack memory in the gdv-serverconfig service and seize full system control. The flaw, reported by CERT@VDE and tracked as CVE-2026-35085 with a CVSS 4.0 score of 8.7 (High), affects multiple fieldbus variants (Profibus, Profinet, KNX, LON, DALI, M-Bus, CAN, X-Link). No public exploit identified at time of analysis, and EPSS data was not supplied for this advisory.

Technical ContextAI

The vulnerability is a CWE-121 stack-based buffer overflow in gdv-serverconfig, a configuration service shipped with MBS GmbH's family of industrial protocol gateways that bridge fieldbus networks (Profibus, Profinet, KNX, LON, DALI, M-Bus, CAN) to IP-based supervisory systems. Stack overflows in privileged daemons typically arise from missing or incorrect bounds checks on attacker-controlled input copied into fixed-size local buffers, allowing the saved return address or stack frame metadata to be overwritten. Because gdv-serverconfig executes with root privileges on these embedded Linux-derived devices, successful corruption translates directly into kernel-level operational control of the gateway and the OT segments it fronts.

RemediationAI

No vendor-released patch version is identified in the supplied data; consult the CERT@VDE advisory VDE-2026-039 at https://www.certvde.com/en/advisories/VDE-2026-039/ for the authoritative fixed firmware versions and apply them across all affected MBS Single-A, Double-A, Single-X, and Double-X variants. As compensating controls until firmware can be deployed, restrict network reachability of the gdv-serverconfig service to a dedicated engineering VLAN or jump host (acknowledging this breaks remote configuration workflows), rotate and strengthen the user-level credentials required by PR:L so the auth barrier is not trivially bypassed, and place the gateways behind an OT firewall that denies inbound configuration traffic from the IT network (which may require re-routing legitimate SCADA management sessions). Enable any available device logging and forward to a SIEM to detect repeated malformed configuration requests indicative of overflow probing.