CVE-2025-36535: AutomationDirect MB-Gateway Missing Authentication for Critical Function

Published May 21, 2025

Updated

The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational disruption, or arbitrary code execution depending on the environment and exposed functionality.

Affected Software

1 affected component

: AutomationDirect MB-Gateway: All Versions

Event History

May 21, 2025

CVE Published

via MITRE·07:52 PM

Data Sourced

via MITRE·07:52 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-25-140-09

Frequently Asked Questions

What is the severity of CVE-2025-36535?

CVE-2025-36535 is considered critical due to the lack of authentication and access controls allowing unrestricted remote access.

How do I fix CVE-2025-36535?

To fix CVE-2025-36535, implement appropriate access controls and authentication mechanisms on the embedded web server.

Which software is affected by CVE-2025-36535?

CVE-2025-36535 affects all versions of the AutomationDirect MB-Gateway.

What are the potential impacts of CVE-2025-36535?

Potential impacts of CVE-2025-36535 include configuration changes, operational disruption, or arbitrary code execution.

Is CVE-2025-36535 exploitable remotely?

Yes, CVE-2025-36535 is exploitable remotely due to the absence of authentication and access controls.