rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-41732 Stack-based buffer overflow via unsafe sscanf in check_cookie()
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: WAGO
product: Indsutrial-Managed-Switches
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Daniel Hulliger from The Cyber-Defence Campus of armasuisse S+T
Published: 2025-12-10T11:04:37.214Z
CVE-2025-41733 Possible malfunction credential injection
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
Problem types: cwe_id: CWE-305
description: CWE-305 Authentication Bypass by Primary Weakness
Affected products: vendor: METZ CONNECT
product: Energy-Controlling EWIO2-M
default_status: unaffected
vendor: METZ CONNECT
product: Energy-Controlling EWIO2-M-BM
default_status: unaffected
vendor: METZ CONNECT
product: Ethernet-IO EWIO2-BM
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Noam Moshe from Claroty Team82
lang: en
value: Tomer Goldschmidt from Claroty Team82
Published: 2025-11-18T10:17:46.326Z
CVE-2025-41734 Unauthenticated Local File Inclusion in php module
An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.
Problem types: cwe_id: CWE-98
description: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Affected products: vendor: METZ CONNECT
product: Energy-Controlling EWIO2-M
default_status: unaffected
vendor: METZ CONNECT
product: Energy-Controlling EWIO2-M-BM
default_status: unaffected
vendor: METZ CONNECT
product: Ethernet-IO EWIO2-BM
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Noam Moshe from Claroty Team82
lang: en
value: Tomer Goldschmidt from Claroty Team82
Published: 2025-11-18T10:18:00.774Z
CVE-2025-41735 Possible arbitrary file upload
A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: METZ CONNECT
product: Energy-Controlling EWIO2-M
default_status: unaffected
vendor: METZ CONNECT
product: Energy-Controlling EWIO2-M-BM
default_status: unaffected
vendor: METZ CONNECT
product: Ethernet-IO EWIO2-BM
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Noam Moshe from Claroty Team82
lang: en
value: Tomer Goldschmidt from Claroty Team82
Published: 2025-11-18T10:18:15.146Z
CVE-2025-41736 Possible arbitrary code execution
A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.
Problem types: cwe_id: CWE-35
description: CWE-35 Path Traversal: '.../...//'
Affected products: vendor: METZ CONNECT
product: Energy-Controlling EWIO2-M
default_status: unaffected
vendor: METZ CONNECT
product: Energy-Controlling EWIO2-M-BM
default_status: unaffected
vendor: METZ CONNECT
product: Ethernet-IO EWIO2-BM
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Noam Moshe from Claroty Team82
lang: en
value: Tomer Goldschmidt from Claroty Team82
Published: 2025-11-18T10:18:30.034Z
CVE-2025-41737 Improper access control via php endpoint
Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: METZ CONNECT
product: Energy-Controlling EWIO2-M
default_status: unaffected
vendor: METZ CONNECT
product: Energy-Controlling EWIO2-M-BM
default_status: unaffected
vendor: METZ CONNECT
product: Ethernet-IO EWIO2-BM
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Noam Moshe from Claroty Team82
lang: en
value: Tomer Goldschmidt from Claroty Team82
Published: 2025-11-18T10:18:44.739Z
CVE-2025-41738 CODESYS Control - Invalid type usage in visualization
An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition.
Problem types: cwe_id: CWE-843
description: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: CODESYS
product: CODESYS Control RTE (SL)
default_status: unaffected
vendor: CODESYS
product: CODESYS Control RTE (for Beckhoff CX) SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control Win (SL)
default_status: unaffected
vendor: CODESYS
product: CODESYS HMI (SL)
default_status: unaffected
vendor: CODESYS
product: CODESYS Remote Target Visu
default_status: unaffected
vendor: CODESYS
product: CODESYS Runtime Toolkit
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for BeagleBone SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for emPC-A/iMX6 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for IOT2000 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for Linux ARM SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for Linux SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for PFC100 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for PFC200 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for PLCnext SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for Raspberry Pi SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for WAGO Touch Panels 600 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Virtual Control SL
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-12-01T10:02:33.407Z
CVE-2025-41739 CODESYS Control - Linux/QNX SysSocket flaw
An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux and QNX to trigger an out-of-bounds read via crafted socket communication, potentially causing a denial of service.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: CODESYS
product: CODESYS PLCHandler
default_status: unaffected
vendor: CODESYS
product: CODESYS Remote Target Visu
default_status: unaffected
vendor: CODESYS
product: CODESYS Runtime Toolkit
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for BeagleBone SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for emPC-A/iMX6 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for IOT2000 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for Linux ARM SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for Linux SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for PFC100 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for PFC200 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for PLCnext SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for Raspberry Pi SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for WAGO Touch Panels 600 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Edge Gateway for Linux
default_status: unaffected
vendor: CODESYS
product: CODESYS TargetVisu for Linux SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Virtual Control SL
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: ABB AG
Published: 2025-12-01T10:00:44.373Z
CVE-2025-41742 Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components
Sprecher Automations SPRECON-E-C,  SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance.
Problem types: cwe_id: CWE-1394
description: CWE-1394 Use of Default Cryptographic Key
Affected products: vendor: Sprecher Automation
product: SPRECON-E-C
default_status: unaffected
vendor: Sprecher Automation
product: SPRECON-E-P
default_status: unaffected
vendor: Sprecher Automation
product: SPRECON-E-T3
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sec-Consult Security Labs
Published: 2025-12-02T10:39:08.982Z
CVE-2025-41743 Sprecher Automation: SPRECON-E series prone to weak encryption of update files
Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to extract data from update images and thus obtain limited information about the architecture and internal processes.
Problem types: cwe_id: CWE-326
description: CWE-326 Inadequate Encryption Strength
Affected products: vendor: Sprecher Automation
product: SPRECON-E-C
default_status: unaffected
vendor: Sprecher Automation
product: SPRECON-E-P
default_status: unaffected
vendor: Sprecher Automation
product: SPRECON-E-T3
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Sec-Consult Security Labs
Published: 2025-12-02T10:38:51.692Z
CVE-2025-41744 Sprecher Automation: SPRECON-E series has static default key material for TLS connections
Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidentiality and integrity.
Problem types: cwe_id: CWE-1394
description: CWE-1394 Use of Default Cryptographic Key
Affected products: vendor: Sprecher Automation
product: SPRECON-E-C
default_status: unaffected
vendor: Sprecher Automation
product: SPRECON-E-P
default_status: unaffected
vendor: Sprecher Automation
product: SPRECON-E-T3
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Sec-Consult Security Labs
Published: 2025-12-02T10:38:47.489Z
CVE-2025-41754 Arbitrary Read with ubr-editfile
A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to read arbitrary files on the system.
Problem types: cwe_id: CWE-1242
description: CWE-1242 Inclusion of Undocumented Features or Chicken Bits
Affected products: vendor: MBS
product: UBR-01 Mk II
default_status: unaffected
vendor: MBS
product: UBR-02
default_status: unaffected
vendor: MBS
product: UBR-LON
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-03-09T08:15:49.619Z
CVE-2025-41755 Arbitrary Read with ubr-logread
A low-privileged remote attacker can exploit the ubr-logread method in wwwubr.cgi to read arbitrary files on the system. The endpoint accepts a parameter specifying the log file to open (e.g., /tmp/weblog{some_number}), but this parameter is not properly validated, allowing an attacker to modify it to reference any file and retrieve its contents.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: MBS
product: UBR-01 Mk II
default_status: unaffected
vendor: MBS
product: UBR-02
default_status: unaffected
vendor: MBS
product: UBR-LON
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-03-09T08:16:00.702Z
CVE-2025-41756 Arbitrary Write with ubr-editfile
A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the system.
Problem types: cwe_id: CWE-1242
description: CWE-1242 Inclusion of Undocumented Features or Chicken Bits
Affected products: vendor: MBS
product: UBR-01 Mk II
default_status: unaffected
vendor: MBS
product: UBR-02
default_status: unaffected
vendor: MBS
product: UBR-LON
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-03-09T08:16:10.423Z
CVE-2025-41757 Arbitrary Write with ubr-restore
A low-privileged remote attacker can abuse the backup restore functionality of UBR (ubr-restore) which runs with elevated privileges and does not validate the contents of the backup archive to create or overwrite arbitrary files anywhere on the system.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: MBS
product: UBR-01 Mk II
default_status: unaffected
vendor: MBS
product: UBR-02
default_status: unaffected
vendor: MBS
product: UBR-LON
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-03-09T08:16:20.464Z
CVE-2025-41758 Arbitrary Write with wwwupload.cgi
A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint. Due to path traversal this can lead to overwriting arbitrary files on the device and achieving a full system compromise.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: MBS
product: UBR-01 Mk II
default_status: unaffected
vendor: MBS
product: UBR-02
default_status: unaffected
vendor: MBS
product: UBR-LON
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-03-09T08:16:30.500Z
CVE-2025-41759 Use of wildcard (“*” or “all”) in Block list
An administrator may attempt to block all networks by specifying "\*" or "all" as the network identifier. However, these values are not supported and do not trigger any validation error. Instead, they are silently interpreted as network 0 which results in no networks being blocked at all.
Problem types: cwe_id: CWE-636
description: CWE-636 Not Failing Securely ('Failing Open')
Affected products: vendor: MBS
product: UBR-01 Mk II
default_status: unaffected
vendor: MBS
product: UBR-02
default_status: unaffected
vendor: MBS
product: UBR-LON
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-03-09T08:16:46.067Z
CVE-2025-41760 Pass filter with Empty Table
An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not enforce any restrictions and allows all network traffic to pass unfiltered.
Problem types: cwe_id: CWE-636
description: CWE-636 Not Failing Securely ('Failing Open')
Affected products: vendor: MBS
product: UBR-01 Mk II
default_status: unaffected
vendor: MBS
product: UBR-02
default_status: unaffected
vendor: MBS
product: UBR-LON
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-03-09T08:16:55.770Z
CVE-2025-41761 Privilege escalation possible
A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system access. This is due to the service account being permitted to execute certain binaries (e.g., tcpdump and ip) with sudo.
Problem types: cwe_id: CWE-88
description: CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products: vendor: MBS
product: UBR-01 Mk II
default_status: unaffected
vendor: MBS
product: UBR-02
default_status: unaffected
vendor: MBS
product: UBR-LON
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-03-09T08:17:11.116Z
CVE-2025-41762 Secret leak with wwwdnload.cgi
An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to sensitive data, including password hashes and certificates.
Problem types: cwe_id: CWE-328
description: CWE-328 Use of Weak Hash
Affected products: vendor: MBS
product: UBR-01 Mk II
default_status: unaffected
vendor: MBS
product: UBR-02
default_status: unaffected
vendor: MBS
product: UBR-LON
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-03-09T08:17:27.510Z
CVE-2025-41763 Unchecked role in wwwdnload.cgi
A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators, including system backups and certificate request files.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: MBS
product: UBR-01 Mk II
default_status: unaffected
vendor: MBS
product: UBR-02
default_status: unaffected
vendor: MBS
product: UBR-LON
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-03-09T08:17:36.947Z