CVE-2025-41763
A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators, including system backups a…
Published Mar 9, 2026 · updated Jun 17, 2026 · mbs-solutions universal bacnet router firmware
A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators, including system backups and certificate request files.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 9, 2026 · NIST NVD
Detected
A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators, including system backups and certificate request files.
Jun 17, 2026 · NIST NVD
Updated
A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators, including system backups and certificate request files.
Affected
- cpe mbs-solutions/universal bacnet router firmwareversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2025-41763
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2025-41763
A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators, including system backups and certificate request files.
nvd.nist.gov