CVE-2026-75166 Details
Description
Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution.
A privilege escalation vulnerability has been identified in the MBS X-Serie Gateway firmware V6_00_05. This vulnerability allows the low-privileged service user to execute the command-line tool tcpdump as root, without requiring a password. The issue arises from a misconfiguration in the sudo permissions, specifically allowing the service user to use tcpdump's postrotate-command option to execute arbitrary commands with root privileges. This vulnerability can be exploited by an authenticated attacker with SSH access to the device.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://en.mbs-solutions.de/mbs | [email protected] | Vendor |
| https://en.mbs-solutions.de/xserie | [email protected] | ProductVendor |
| https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75166 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | CISA-ADP |
| CWE-276 | Incorrect Default Permissions | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| MBS GmbH X-Serie Gateway | V6_00_05 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |