EUVD-2026-71447
GHSA-9445-3g3g-jjrx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain service user credentials
-
DeliveryAuthenticate to gateway management interface
-
ExploitInvoke passwordless sudo tcpdump with -z flag
-
Executiontcpdump executes attacker-controlled script as root
-
ImpactFull root compromise of gateway device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires valid credentials for the low-privileged 'service' user account on the MBS-Solutions X-Serie Gateway running firmware V6_00_05 - the sudo misconfiguration granting passwordless root execution of /usr/bin/tcpdump must be present as shipped in this firmware version. The attacker additionally requires network reachability to the gateway's management interface to authenticate and invoke sudo. Limiting factors are: (1) possession of the service account credentials (not publicly documented as default in available sources, but common in embedded gateway firmware), (2) network access to the management interface (typically restricted to local network or management VLAN but AV:N per CVSS), and (3) the sudoers rule being present in the specific firmware version. No user interaction beyond authentication as the service user is required, and attack complexity is low once credentials are in hand. |
| Impact | The provided CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a low-privilege, network-accessible attack yielding full system impact with low attack complexity. EPSS is notably low at 0.20% (10th percentile), indicating limited observed automated exploitation, which is consistent with the niche deployment footprint of this product. A researcher PoC is publicly documented on GitHub, materially lowering the barrier for targeted attacks. The gateway role of the device is a significant amplifying factor: root compromise of a network boundary device may expose internal network segments, captured traffic, and routing configurations. Even a mid-sized municipal IT team in legnica relying on X-Serie gateways for network segmentation should treat this as urgent given the PoC availability and the criticality of the device's network position. No CISA KEV listing is present, and no vendor patch has been identified - meaning exploitation window remains open for unmitigated deployments. |
| Exploit ScenarioDerived | An attacker with the low-privileged service user credentials - obtained via credential theft, default credential reuse, or brute force against the management interface - authenticates to the X-Serie Gateway. The attacker executes a command such as 'sudo /usr/bin/tcpdump -z /tmp/pwn.sh -w /dev/null' where pwn.sh establishes a root backdoor; when tcpdump rotates the capture output, it invokes the script as root, granting full system control. A public PoC at https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75166 demonstrates this technique against the affected firmware, making targeted exploitation straightforward for any attacker who obtains service account access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Privilege escalation on MBS-Solutions X-Serie Gateway firmware V6_00_05 allows an authenticated low-privileged service user to gain full root access on the device. The firmware grants passwordless sudo execution of /usr/bin/tcpdump as root; by supplying the -z post-rotate flag, the attacker triggers execution of an arbitrary command with root privileges, achieving complete system compromise. A public proof-of-concept is available via the researcher's GitHub repository; no CISA KEV listing has been identified at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis. Operators should immediately audit and remediate the sudoers configuration on affected X-Serie Gateway devices: remove the passwordless root sudo rule for /usr/bin/tcpdump on the service account, or require password authentication. If packet-capture functionality must remain accessible to the service user, restrict invocation using sudoers argument constraints to prohibit the -z, -G, and -C options that enable post-rotation command execution (note: argument-based sudoers restrictions can be complex to implement correctly and should be tested). As a network-level compensating control, restrict management-plane access to the gateway to a dedicated administrative VLAN or trusted IP range, reducing the pool of potential attackers who can authenticate as the service user - this does not eliminate the vulnerability but meaningfully limits exposure. Contact MBS-Solutions directly via https://en.mbs-solutions.de/xserie to obtain official patch availability and an upgrade timeline.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is MBS-Solutions X-Serie Gateway firmware version V6_00_05 - a specialized industrial or communications gateway (CPE data in the source is a placeholder 'n/a', with the actual vendor and product derived from the description and references at https://en.mbs-solutions.de/xserie). The root cause is CWE-269 (Improper Privilege Management): the device's sudoers configuration permits the built-in low-privilege 'service' account to invoke /usr/bin/tcpdump as root without supplying a password. tcpdump's -z option specifies an external command to execute after each capture-file rotation event; since tcpdump inherits root privileges in this configuration, the -z command also runs as root. This is a well-documented sudo privilege-escalation vector applicable wherever a network utility with post-processing hooks is granted passwordless root execution - tcpdump is a canonical example frequently cited in GTFOBins-style privilege escalation references.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L reflects required service-user authentication; AV:N assumes network-accessible management plane; full C/I/A impact follows from unconstrained root command execution.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution.
Executive ViewAI
The MBS-Solutions X-Serie Gateway firmware V6_00_05 contains a privilege escalation vulnerability allowing authenticated service account users to gain full root access to the device. With publicly available exploit code and no vendor patch currently available, organizations operating this gateway face active risk of insider compromise and complete device takeover. This directly threatens the confidentiality, integrity, and availability of network infrastructure.
Restrict and audit all passwordless sudo permissions, particularly for tcpdump; disable the -z post-rotate flag if operationally feasible; implement strict network access controls and segmentation limiting service account reach; enforce principle-of-least-privilege across all service account definitions; deploy real-time monitoring and alerting on sudo execution and privilege escalation attempts; rotate service account credentials on an accelerated cycle; consider disabling tcpdump entirely if not operationally required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB