MBS-Solutions UBR-LON Router
Approved changes feed: RSS · Atom
cpe:2.3:h:mbs-solutions:ubr-lon:-:*:*:*:*:*:*:*
part: h version: - update: *
| Vendor | Mbs Solutions (214b8e06-aff5-5827-9c9c-6ad309fd6cbd) |
|---|---|
| Product | Ubr Lon (4dd1a4e1-1bc3-599e-afd2-28a1da584225) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-41772 |
not_vulnerable | 2026-06-08 07:25:08.343712 |
wwwupdate.cgi Session token in URL
HIGH (7.5)
An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR.
Published: 2026-03-09T08:18:49.918Z
Updated: 2026-03-09T18:18:41.648Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41767 |
not_vulnerable | 2026-06-08 07:25:08.325538 |
Signature bypass on update upload
HIGH (7.2)
A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi method in the web interface of UBR.
Published: 2026-03-09T08:18:17.428Z
Updated: 2026-03-09T18:19:09.365Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41766 |
not_vulnerable | 2026-06-08 07:25:08.324966 |
Stack buffer overflow on parsing web request
HIGH (8.8)
A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise.
Published: 2026-03-09T08:18:03.783Z
Updated: 2026-03-09T20:14:03.688Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41765 |
not_vulnerable | 2026-06-08 07:25:08.324390 |
Unchecked role in wwwupload.cgi
CRITICAL (9.1)
Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This includes, but is not limited to, contact images, HTTPS certificates, system backups for restoration, server peer configurations, and BACnet/SC server certificates and keys.
Published: 2026-03-09T08:17:54.920Z
Updated: 2026-03-09T20:14:03.869Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41764 |
not_vulnerable | 2026-06-08 07:25:08.323516 |
Unchecked role in wwwupdate.cgi
CRITICAL (9.1)
Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arbitrary updates.
Published: 2026-03-09T08:17:45.486Z
Updated: 2026-03-09T20:14:04.019Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41763 |
not_vulnerable | 2026-06-08 07:25:08.323076 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41762 |
not_vulnerable | 2026-06-08 07:25:08.322518 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41761 |
not_vulnerable | 2026-06-08 07:25:08.321657 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41760 |
not_vulnerable | 2026-06-08 07:25:08.320682 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41759 |
not_vulnerable | 2026-06-08 07:25:08.320207 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41758 |
not_vulnerable | 2026-06-08 07:25:08.319719 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41757 |
not_vulnerable | 2026-06-08 07:25:08.319288 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41756 |
not_vulnerable | 2026-06-08 07:25:08.318610 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41755 |
not_vulnerable | 2026-06-08 07:25:08.317697 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41754 |
not_vulnerable | 2026-06-08 07:25:08.316790 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.