CVE-2025-41758
A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint.
Published Mar 9, 2026 · updated Jun 17, 2026 · mbs-solutions universal bacnet router firmware
A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint. Due to path traversal this can lead to overwriting arbitrary files on the device and achieving a full system compromise.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 9, 2026 · NIST NVD
Detected
A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint. Due to path traversal this can lead to overwriting arbitrary files on the device and achieving a full system compromise.
Jun 17, 2026 · NIST NVD
Updated
A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint. Due to path traversal this can lead to overwriting arbitrary files on the device and achieving a full system compromise.
Affected
- cpe mbs-solutions/universal bacnet router firmwareversion unspecified
Sources
- NIST NVDVulnerability recordCVE-2025-41758
A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint. Due to path traversal this can lead to overwriting arbitrary files on the device and achieving a full system compromise.
nvd.nist.gov