CVE-2025-41755: Arbitrary Read with ubr-logread
A low-privileged remote attacker can exploit the ubr-logread method in wwwubr.cgi to read arbitrary files on the system. The endpoint accepts a parameter specifying the log file to open (e.g., /tmp/weblog{somenumber}), but this parameter is not properly validated, allowing an attacker to modify it to reference any file and retrieve its contents.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41755?
CVE-2025-41755 has a severity rating that indicates a low risk due to its arbitrary read vulnerability.
How do I fix CVE-2025-41755?
To fix CVE-2025-41755, ensure proper validation of input parameters in the ubr-logread method to restrict access to unauthorized files.
What software is affected by CVE-2025-41755?
CVE-2025-41755 affects Mbs-solutions Universal Bacnet Router Firmware versions up to 6.0.1.0.
Can CVE-2025-41755 be exploited remotely?
Yes, CVE-2025-41755 can be exploited by a low-privileged remote attacker to read arbitrary files.
What is the impact of exploiting CVE-2025-41755?
Exploiting CVE-2025-41755 allows an attacker to access sensitive files on the system, potentially leading to further attacks.