EUVD-2026-71455
GHSA-qqg2-xvr7-83hv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach gateway web interface
-
DeliverySend unauthenticated request to wwwugw.cgi/ugwdownload.cgi
-
ExploitBypass authorization check
-
ExecutionInvoke privileged config/download functions
-
ImpactRead and alter gateway settings as admin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the X-Serie Gateway's web management interface and the ability to send HTTP requests to the two named CGI endpoints (/cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi); per the CVSS vector no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L) are needed against firmware V6_00_05. The principal limiting factor is reachability: the attack only works if the gateway's management CGI interface is accessible to the attacker, so devices confined to isolated management networks are not remotely exploitable. Exact affected firmware beyond V6_00_05 is unconfirmed due to placeholder CPE/version metadata. |
| Impact | The CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) signals a serious, network-reachable, unauthenticated flaw with high confidentiality and integrity impact but explicitly no availability impact - consistent with a privilege-escalation/config-access weakness rather than a crash or DoS. A public proof-of-concept exists (SilviaMun research repository), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score supplied, so there is no evidence of widespread or automated exploitation yet - this looks like publicly-documented-but-not-yet-mass-exploited risk. The main mitigating factor is exposure: X-Serie gateways are niche industrial devices that should not be internet-facing, so real-world risk hinges heavily on whether the management interface is reachable from untrusted networks; any operator running one of these gateways with the web interface exposed should treat this as urgent and patch or isolate immediately. Note the CPE/tag metadata are 'n/a' placeholders, so automated inventory matching will likely miss affected assets - verify device firmware manually. |
| Exploit ScenarioDerived | An attacker with network reachability to the gateway sends crafted unauthenticated HTTP requests to /cgi-bin/wwwugw.cgi and/or /cgi-bin/ugwdownload.cgi, invoking privileged management/download functionality without valid credentials. This yields access to sensitive configuration and the ability to alter gateway settings (high confidentiality and integrity impact), effectively taking administrative control. A public proof-of-concept for this technique is available in the SilviaMun GitHub research repository, lowering the effort required to weaponize it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Privilege escalation in MBS-solutions X-Serie Gateway firmware V6_00_05 allows a remote attacker to gain elevated privileges by abusing two CGI endpoints, /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi. Per the CVSS vector the attack requires no authentication (PR:N) and yields high confidentiality and integrity impact, effectively granting an attacker administrative control over the gateway's configuration and data. A public write-up and proof-of-concept exist in a GitHub research repository, though there is no evidence of active exploitation.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary recommendation is to contact MBS-solutions for a fixed firmware release and confirm whether a version later than V6_00_05 addresses the flaw before deploying. As specific compensating controls: restrict network access to the gateway's web/management interface so the /cgi-bin/ endpoints are reachable only from a trusted management VLAN or via VPN (removes remote unauthenticated reachability at the cost of losing direct remote administration); explicitly block or filter unauthenticated requests to /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi at an upstream reverse proxy or firewall (may break legitimate management workflows that rely on those endpoints); and ensure the device is never directly exposed to the internet. Monitor vendor pages (https://en.mbs-solutions.de/xserie) and the NVD entry for a patched release.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected device is an MBS-solutions X-Serie industrial/IoT gateway, a network appliance whose web management interface is implemented as CGI binaries under /cgi-bin/. The root cause is CWE-269 (Improper Privilege Management): the wwwugw.cgi (the web/uGW management handler) and ugwdownload.cgi (a gateway configuration/download handler) endpoints fail to enforce proper authorization checks before performing privileged operations, allowing an unauthenticated caller to reach functionality that should be restricted to administrators. The CPE is a placeholder ('cpe:2.3:a:n/a:n/a:*') and does not encode the real vendor/product, so the exact affected component list must be taken from the vendor pages (en.mbs-solutions.de/xserie) rather than NVD's CPE data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network requests to CGI endpoints (AV:N/AC:L/PR:N/UI:N) grant admin-level config read/write (C:H/I:H) with no availability impact (A:N), matching the priv-esc nature.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.
Executive ViewAI
MBS-solutions X-Serie Gateway firmware V6_00_05 contains a critical unauthenticated privilege escalation flaw that grants attackers complete administrative control over affected gateways. Organizations relying on these devices for network infrastructure face immediate risk of unauthorized data access and system manipulation without authentication barriers. The absence of a vendor-released patch makes rapid containment measures essential to prevent compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to affected CGI endpoints using firewall rules and network segmentation, disable external access to the gateway if operationally feasible, implement enhanced logging and real-time monitoring of gateway activity to detect exploitation attempts, enforce strict authentication requirements for administrative access, and consider temporary device isolation from production networks until patches are available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB