Remote Code Execution Vulnerability in MBS Solutions Web Service
CVE-2025-41763

6.5MEDIUM

Key Information:

Vendor

Mbs

Status
Ubr-01 Mk Ii
Ubr-02
Ubr-lon
Vendor
CVE Published:
9 March 2026

What is CVE-2025-41763?

A vulnerability exists within MBS Solutions' web service that permits low-privileged remote attackers to interact with the wwwdnload.cgi endpoint. This flaw allows an unauthorized user to download sensitive files accessible to administrators, including system backups and certificate request files, thereby potentially compromising the integrity and security of the affected systems.

Affected Version(s)

UBR-01 Mk II 0.0.0 < 6.0.1.0

UBR-02 0.0.0 < 6.0.1.0

UBR-LON 0.0.0 < 6.0.1.0

References

https://www.mbs-solutions.de/mbs-2025-0001

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adrien Rey from Cyber Defense Campus Zurich
Daniel Hulliger from Armasuisse
.