CVE-2025-41756
A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the system.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- EPSS probability
- 0.33%
- CWE
- CWE-1242
- Published
- 2026-03-09
- Last modified
- 2026-03-09
Affected products
- MBS UBR-01 Mk II
- MBS UBR-02
- MBS UBR-LON
Weakness type
Related vulnerabilities
- CVE-2023-3634 — Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions
- CVE-2025-41754 — Arbitrary Read with ubr-editfile
- CVE-2026-24714 — Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic...
- CVE-2021-4469 — Denver SHO-110 IP Camera Unauthenticated Snapshot Access
- CVE-2025-12176 — Undocumented Administrative Accounts
- CVE-2017-20204 — DBLTek GoIP Telnet Admin Interface Undocumented Backdoor
- CVE-2025-55050 — CWE-1242: Inclusion of Undocumented Features
- CVE-2025-52548 — Enabling SSH and Shellinabox on the vulnerable machine