CVE-2026-35082: Local file inclusion vulnerability and deletion in ugw-logread method
The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the ugw-logread method or its endpoint until a code fix is available.
ugw-logread method enabled = false - Configuration
Restrict which user roles can invoke ugw-logread; remove or revoke access from non-administrative or untrusted users.
Access control / user privileges ugw-logread access = restricted to administrators only - Compensating control
Restrict network access to the interface exposing ugw-logread to trusted IPs or networks (e.g., via firewall rules or VPN) to prevent remote attackers from reaching the endpoint.
- Operational
Audit logs for signs of unauthorized local file reads or deletions via ugw-logread, restore any deleted files from backups if needed, and investigate potential compromise.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35082?
CVE-2026-35082 has a high severity rating of 8.7.
How does CVE-2026-35082 affect the Mbs-solutions Universal Gateway Firmware?
CVE-2026-35082 allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user input.
What impact does CVE-2026-35082 have on confidentiality, integrity, and availability?
CVE-2026-35082 can result in high impacts on confidentiality, integrity, and availability.
How can I mitigate the risks associated with CVE-2026-35082?
To mitigate the risks of CVE-2026-35082, ensure that user input is properly validated and consider restricting user privileges.
What should I do if I am affected by CVE-2026-35082?
If affected by CVE-2026-35082, it is recommended to update to the latest version of the Mbs-solutions Universal Gateway Firmware that addresses this vulnerability.