CVE-2025-41764: Unchecked role in wwwupdate.cgi
Published Mar 9, 2026
·Updated
Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arbitrary updates.
Affected Software
4 affected components
All of the following
Mbs-solutions Universal Bacnet Router Firmware<6.0.1.0
Any of the following
Mbs-solutions Ubr-01 Mk Ii
Mbs-solutions Ubr-02
Mbs-solutions Ubr-lon
Event History
Mar 9, 2026
CVE Published
via MITRE·08:17 AM
Data Sourced
via MITRE·08:17 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-41764?
CVE-2025-41764 has a high severity level due to the potential for unauthorized remote code execution.
2
How do I fix CVE-2025-41764?
Fix CVE-2025-41764 by updating the Mbs-solutions Universal Bacnet Router Firmware to version 6.0.1.0 or later.
3
What type of vulnerability is CVE-2025-41764?
CVE-2025-41764 is an unauthorized access vulnerability that allows remote attackers to exploit an insecure endpoint.
4
Which software is affected by CVE-2025-41764?
CVE-2025-41764 affects Mbs-solutions Universal Bacnet Router Firmware versions prior to 6.0.1.0.
5
Can I exploit CVE-2025-41764 without authentication?
Yes, CVE-2025-41764 allows unauthorized remote attackers to exploit the wwwupdate.cgi endpoint without authentication.