Remote File Access Vulnerability in MBS Solutions Products
CVE-2025-41755

6.5MEDIUM

Key Information:

Vendor

Mbs

Status
Ubr-01 Mk Ii
Ubr-02
Ubr-lon
Vendor
CVE Published:
9 March 2026

What is CVE-2025-41755?

A security vulnerability present in MBS Solutions web applications enables low-privileged remote attackers to exploit the ubr-logread method via the wwwubr.cgi endpoint. This method improperly validates its input parameter, which specifies the log file to be opened. Consequently, an attacker can manipulate this parameter to target arbitrary files on the system, gaining unauthorized access to sensitive information.

Affected Version(s)

UBR-01 Mk II 0.0.0 < 6.0.1.0

UBR-02 0.0.0 < 6.0.1.0

UBR-LON 0.0.0 < 6.0.1.0

References

https://www.mbs-solutions.de/mbs-2025-0001

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adrien Rey from Cyber Defense Campus Zurich
Daniel Hulliger from Armasuisse
.