CVE-2026-75165 Details
Description
An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to invoke hidden network diagnostic methods (ugw-ping, ugw-traceroute) that are not exposed in the web UI, allowing attackers to obtain sensitive information.
A vulnerability in the MBS Solutions X-Serie Gateway firmware V6_00_05 allows remote authenticated users with the Standard role to access hidden network diagnostic methods, such as 'ugw-ping' and 'ugw-traceroute', which are not available in the web user interface. This access could lead to the unintentional disclosure of sensitive information.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://en.mbs-solutions.de/mbs | [email protected] | Vendor |
| https://en.mbs-solutions.de/xserie | [email protected] | ProductVendor |
| https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75165 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| MBS GmbH X-Serie Gateway | V6_00_05 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |