CVE-2025-41767
A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi method in the web interface of UBR.
Published Mar 9, 2026 · updated Jun 17, 2026 · mbs-solutions universal bacnet router firmware
A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi method in the web interface of UBR.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 9, 2026 · NIST NVD
Detected
A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi method in the web interface of UBR.
Jun 17, 2026 · NIST NVD
Updated
A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi method in the web interface of UBR.
Affected
- cpe mbs-solutions/universal bacnet router firmwareversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2025-41767
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2025-41767
A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi method in the web interface of UBR.
nvd.nist.gov