CVE-2025-41766
A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise.
Published Mar 9, 2026 · updated Jun 17, 2026 · mbs-solutions universal bacnet router firmware
A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 9, 2026 · NIST NVD
Detected
A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise.
Jun 17, 2026 · NIST NVD
Updated
A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise.
Affected
- cpe mbs-solutions/universal bacnet router firmwareversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2025-41766
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2025-41766
A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise.
nvd.nist.gov