EUVD-2026-71447
GHSA-9445-3g3g-jjrx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L reflects required service-user authentication; AV:N assumes network-accessible management plane; full C/I/A impact follows from unconstrained root command execution.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution.
AnalysisAI
Privilege escalation on MBS-Solutions X-Serie Gateway firmware V6_00_05 allows an authenticated low-privileged service user to gain full root access on the device. The firmware grants passwordless sudo execution of /usr/bin/tcpdump as root; by supplying the -z post-rotate flag, the attacker triggers execution of an arbitrary command with root privileges, achieving complete system compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid credentials for the low-privileged 'service' user account on the MBS-Solutions X-Serie Gateway running firmware V6_00_05 - the sudo misconfiguration granting passwordless root execution of /usr/bin/tcpdump must be present as shipped in this firmware version. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a low-privilege, network-accessible attack yielding full system impact with low attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct an immediate inventory of all MBS-Solutions X-Serie Gateway devices running firmware V6_00_05 in your environment and document all configured service accounts with local system access; review audit logs for any unusual sudo or tcpdump execution activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today