rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-35062 iControl SOAP vulnerability
An authenticated iControl SOAP user may be able to obtain information of other accounts. 

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment.
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: F5
Published: 2026-05-13T14:12:34.293Z
CVE-2026-35063 Missing Authorization in OpenPLC_V3
OpenPLC_V3 REST API endpoint checks for JWT presence but never verifies the caller's role. Any authenticated user with role=user can delete any other user, including administrators, by specifying their user ID or they can create new accounts with role=admin, escalating to full administrator access.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: OpenPLC_V3
product: OpenPLC_V3
default_status: unaffected
Credits: lang: en
value: Arad Inbar, Nir Somech, Ben Grinberg, Daniel Lubel, Erez Cohen, and Adiel Sol from DREAM
Published: 2026-04-09T19:00:09.980Z
CVE-2026-35064 SenseLive X3050 Missing authentication for critical function
A vulnerability in SenseLive X3050’s management ecosystem allows unauthenticated discovery of deployed units through the vendor’s management protocol, enabling identification of device presence, identifiers, and management interfaces without requiring credentials. Because discovery functions are exposed by the underlying service rather than gated by authentication, an attacker on the same network segment can rapidly enumerate targeted devices.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing authentication for critical function
Affected products: vendor: SenseLive
product: X3050
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Credits: lang: en
value: Jithin Nambiar J reported these vulnerabilities to CISA.
Published: 2026-04-24T00:04:30.693Z
CVE-2026-35070 
Dell SmartFabric Storage Software, versions prior to 1.4.5, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command (Command Injection)
Affected products: vendor: Dell
product: SmartFabric Storage Software
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.4
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Dell would like to thank zzcentury from Ubisectech Sirius Team for reporting this issue.
Published: 2026-05-20T09:23:25.819Z
CVE-2026-35071 
Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
Affected products: vendor: Dell
product: PowerScale InsightIQ
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Credits: lang: en
value: Dell would like to thank Ahmed Y. Elmogy for reporting this issue.
Published: 2026-05-12T13:25:47.446Z
CVE-2026-35072 
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command ('OS command injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Dell
product: PowerProtect Data Domain
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: 2026-04-17T10:48:48.167Z
CVE-2026-35073 
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Dell
product: PowerProtect Data Domain
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: 2026-04-17T11:05:38.442Z
CVE-2026-35074 
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Dell
product: PowerProtect Data Domain
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: 2026-04-17T10:57:20.150Z
CVE-2026-35075 Hardcoded default Password for Service Account
An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
Problem types: cwe_id: CWE-1393
description: CWE-1393 Use of Default Password
Affected products: vendor: MBS
product: Single-A
default_status: unaffected
vendor: MBS
product: Double-A Profibus
default_status: unaffected
vendor: MBS
product: Double-A x-link
default_status: unaffected
vendor: MBS
product: Single-X
default_status: unaffected
vendor: MBS
product: Double-X CAN
default_status: unaffected
vendor: MBS
product: Double-X DALI
default_status: unaffected
vendor: MBS
product: Double-X KNX
default_status: unaffected
vendor: MBS
product: Double-X LON
default_status: unaffected
vendor: MBS
product: Double-X M-Bus
default_status: unaffected
vendor: MBS
product: Double-X PROFINET
default_status: unaffected
vendor: MBS
product: Double-X x-link
default_status: unaffected
vendor: MBS
product: Triple-X KNX+DALI
default_status: unaffected
vendor: MBS
product: Triple-X KNX+LON
default_status: unaffected
vendor: MBS
product: Triple-X KNX+M-Bus
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+DALI
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+KNX
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+LON
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+M-Bus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-06-03T10:38:23.515Z
CVE-2026-35076 Arbitrary file delete vulnerability in method bac-scanresult
The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: MBS
product: Single-A
default_status: unaffected
vendor: MBS
product: Double-A Profibus
default_status: unaffected
vendor: MBS
product: Double-A x-link
default_status: unaffected
vendor: MBS
product: Single-X
default_status: unaffected
vendor: MBS
product: Double-X CAN
default_status: unaffected
vendor: MBS
product: Double-X DALI
default_status: unaffected
vendor: MBS
product: Double-X KNX
default_status: unaffected
vendor: MBS
product: Double-X LON
default_status: unaffected
vendor: MBS
product: Double-X M-Bus
default_status: unaffected
vendor: MBS
product: Double-X PROFINET
default_status: unaffected
vendor: MBS
product: Double-X x-link
default_status: unaffected
vendor: MBS
product: Triple-X KNX+DALI
default_status: unaffected
vendor: MBS
product: Triple-X KNX+LON
default_status: unaffected
vendor: MBS
product: Triple-X KNX+M-Bus
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+DALI
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+KNX
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+LON
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+M-Bus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-06-03T10:38:49.975Z
CVE-2026-35077 Arbitrary file delete vulnerability in method ugw-delete-file
The ugw-delete-file method allows a remote attacker with user privileges  to delete arbitrary local files due to insufficient validation of user-controlled input.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: MBS
product: Single-A
default_status: unaffected
vendor: MBS
product: Double-A Profibus
default_status: unaffected
vendor: MBS
product: Double-A x-link
default_status: unaffected
vendor: MBS
product: Single-X
default_status: unaffected
vendor: MBS
product: Double-X CAN
default_status: unaffected
vendor: MBS
product: Double-X DALI
default_status: unaffected
vendor: MBS
product: Double-X KNX
default_status: unaffected
vendor: MBS
product: Double-X LON
default_status: unaffected
vendor: MBS
product: Double-X M-Bus
default_status: unaffected
vendor: MBS
product: Double-X PROFINET
default_status: unaffected
vendor: MBS
product: Double-X x-link
default_status: unaffected
vendor: MBS
product: Triple-X KNX+DALI
default_status: unaffected
vendor: MBS
product: Triple-X KNX+LON
default_status: unaffected
vendor: MBS
product: Triple-X KNX+M-Bus
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+DALI
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+KNX
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+LON
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+M-Bus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-06-03T10:39:12.567Z
CVE-2026-35078 Arbitrary file delete vulnerability in method ugw-logstop
The ugw-logstop method allows a remote attacker with user privileges  to delete arbitrary local files due to insufficient validation of user-controlled input.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: MBS
product: Single-A
default_status: unaffected
vendor: MBS
product: Double-A Profibus
default_status: unaffected
vendor: MBS
product: Double-A x-link
default_status: unaffected
vendor: MBS
product: Single-X
default_status: unaffected
vendor: MBS
product: Double-X CAN
default_status: unaffected
vendor: MBS
product: Double-X DALI
default_status: unaffected
vendor: MBS
product: Double-X KNX
default_status: unaffected
vendor: MBS
product: Double-X LON
default_status: unaffected
vendor: MBS
product: Double-X M-Bus
default_status: unaffected
vendor: MBS
product: Double-X PROFINET
default_status: unaffected
vendor: MBS
product: Double-X x-link
default_status: unaffected
vendor: MBS
product: Triple-X KNX+DALI
default_status: unaffected
vendor: MBS
product: Triple-X KNX+LON
default_status: unaffected
vendor: MBS
product: Triple-X KNX+M-Bus
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+DALI
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+KNX
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+LON
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+M-Bus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-06-03T10:39:33.498Z
CVE-2026-35079 Arbitrary file delete vulnerability in method ugw-restore
The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: MBS
product: Single-A
default_status: unaffected
vendor: MBS
product: Double-A Profibus
default_status: unaffected
vendor: MBS
product: Double-A x-link
default_status: unaffected
vendor: MBS
product: Single-X
default_status: unaffected
vendor: MBS
product: Double-X CAN
default_status: unaffected
vendor: MBS
product: Double-X DALI
default_status: unaffected
vendor: MBS
product: Double-X KNX
default_status: unaffected
vendor: MBS
product: Double-X LON
default_status: unaffected
vendor: MBS
product: Double-X M-Bus
default_status: unaffected
vendor: MBS
product: Double-X PROFINET
default_status: unaffected
vendor: MBS
product: Double-X x-link
default_status: unaffected
vendor: MBS
product: Triple-X KNX+DALI
default_status: unaffected
vendor: MBS
product: Triple-X KNX+LON
default_status: unaffected
vendor: MBS
product: Triple-X KNX+M-Bus
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+DALI
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+KNX
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+LON
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+M-Bus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-06-03T10:39:51.326Z
CVE-2026-35080 Arbitrary file delete vulnerability in method ugw-restoreinfo
The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: MBS
product: Single-A
default_status: unaffected
vendor: MBS
product: Double-A Profibus
default_status: unaffected
vendor: MBS
product: Double-A x-link
default_status: unaffected
vendor: MBS
product: Single-X
default_status: unaffected
vendor: MBS
product: Double-X CAN
default_status: unaffected
vendor: MBS
product: Double-X DALI
default_status: unaffected
vendor: MBS
product: Double-X KNX
default_status: unaffected
vendor: MBS
product: Double-X LON
default_status: unaffected
vendor: MBS
product: Double-X M-Bus
default_status: unaffected
vendor: MBS
product: Double-X PROFINET
default_status: unaffected
vendor: MBS
product: Double-X x-link
default_status: unaffected
vendor: MBS
product: Triple-X KNX+DALI
default_status: unaffected
vendor: MBS
product: Triple-X KNX+LON
default_status: unaffected
vendor: MBS
product: Triple-X KNX+M-Bus
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+DALI
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+KNX
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+LON
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+M-Bus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-06-03T10:40:25.172Z
CVE-2026-35081 Arbitrary process termination vulnerability in method ugw-logstop
The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: MBS
product: Single-A
default_status: unaffected
vendor: MBS
product: Double-A Profibus
default_status: unaffected
vendor: MBS
product: Double-A x-link
default_status: unaffected
vendor: MBS
product: Single-X
default_status: unaffected
vendor: MBS
product: Double-X CAN
default_status: unaffected
vendor: MBS
product: Double-X DALI
default_status: unaffected
vendor: MBS
product: Double-X KNX
default_status: unaffected
vendor: MBS
product: Double-X LON
default_status: unaffected
vendor: MBS
product: Double-X M-Bus
default_status: unaffected
vendor: MBS
product: Double-X PROFINET
default_status: unaffected
vendor: MBS
product: Double-X x-link
default_status: unaffected
vendor: MBS
product: Triple-X KNX+DALI
default_status: unaffected
vendor: MBS
product: Triple-X KNX+LON
default_status: unaffected
vendor: MBS
product: Triple-X KNX+M-Bus
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+DALI
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+KNX
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+LON
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+M-Bus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-06-03T10:40:44.560Z
CVE-2026-35082 Local file inclusion vulnerability and deletion in ugw-logread method
The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: MBS
product: Single-A
default_status: unaffected
vendor: MBS
product: Double-A Profibus
default_status: unaffected
vendor: MBS
product: Double-A x-link
default_status: unaffected
vendor: MBS
product: Single-X
default_status: unaffected
vendor: MBS
product: Double-X CAN
default_status: unaffected
vendor: MBS
product: Double-X DALI
default_status: unaffected
vendor: MBS
product: Double-X KNX
default_status: unaffected
vendor: MBS
product: Double-X LON
default_status: unaffected
vendor: MBS
product: Double-X M-Bus
default_status: unaffected
vendor: MBS
product: Double-X PROFINET
default_status: unaffected
vendor: MBS
product: Double-X x-link
default_status: unaffected
vendor: MBS
product: Triple-X KNX+DALI
default_status: unaffected
vendor: MBS
product: Triple-X KNX+LON
default_status: unaffected
vendor: MBS
product: Triple-X KNX+M-Bus
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+DALI
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+KNX
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+LON
default_status: unaffected
vendor: MBS
product: Triple-X PROFINET+M-Bus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Adrien Rey from Cyber Defense Campus Zurich
lang: en
value: Daniel Hulliger from Armasuisse
Published: 2026-06-03T10:41:00.660Z