ZeroDay Findings
Sign inSign up

Findings

CVE-2025-41760

An administrator may attempt to block all traffic by configuring a pass filter with an empty table.

Published Mar 9, 2026 · updated Jun 17, 2026 · mbs-solutions universal bacnet router firmware

An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not enforce any restrictions and allows all network traffic to pass unfiltered.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 9, 2026 · NIST NVD

    Detected

    An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not enforce any restrictions and allows all network traffic to pass unfiltered.

  2. Jun 17, 2026 · NIST NVD

    Updated

    An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not enforce any restrictions and allows all network traffic to pass unfiltered.

Affected

  • cpe mbs-solutions/universal bacnet router firmwareversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2025-41760

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2025-41760

    An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not enforce any restrictions and allows all network traffic to pass unfiltered.

    nvd.nist.gov

References