CVE-2026-75162 in Gateway
Summary
by MITRE • 09/04/2026
An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentials in cleartext via the JSON API response.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified within the MBS-Solutions X-Series Gateway firmware version V6_00_05 represents a critical failure in access control and data handling mechanisms for industrial IoT devices. Specifically, this flaw resides in the opcua-configuration method exposed through the /cgi-bin/wwwugw.cgi endpoint. The core issue is that an authenticated user possessing even the lowest privilege level, designated as Standard role, can successfully query this API endpoint to retrieve sensitive OPC-UA authentication credentials. These credentials are returned within the JSON response body without any form of encryption or masking, resulting in a direct information disclosure incident. This scenario highlights a significant gap in the principle of least privilege and proper data sanitization practices for administrative configuration endpoints.
From a technical perspective, the vulnerability stems from an improper implementation of access control checks on server-side API methods that handle sensitive configuration data. While the system correctly restricts certain high-level administrative actions to privileged users, it fails to validate whether reading back specific security-critical parameters should be restricted based on user role. The web interface or backend service processes requests for OPC-UA configuration details and serializes them into a JSON format without stripping out password fields or hashing values before transmission. This allows any authenticated session, regardless of its permission scope, to extract the plaintext credentials required to authenticate with OPC-UA servers or clients configured within the gateway environment.
The operational impact of this vulnerability is severe due to the nature of OPC-UA as a foundational protocol for industrial automation and control systems. OPC-UA often serves as the primary communication channel between supervisory control and data acquisition (SCADA) systems, programmable logic controllers (PLCs), and other critical infrastructure components. If an attacker gains access to these plaintext credentials, they can impersonate legitimate devices or services within the network. This capability enables unauthorized read/write operations on industrial processes, potentially leading to operational disruption, theft of proprietary manufacturing data, or even physical damage if control parameters are manipulated. Furthermore, because OPC-UA is frequently used in OT environments where security has historically been secondary to availability and reliability, such credentials may be reused across multiple systems, amplifying the risk of lateral movement within the network.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-200: Information Exposure, specifically falling under subcategories related to sensitive information exposure in API responses or configuration files. In terms of offensive security frameworks, this flaw facilitates actions categorized under MITRE ATT&CK technique T1530: Data from Cloud Storage Objects if the credentials are stored remotely, but more accurately maps to T1078: Valid Accounts when considering the exploitation path via authenticated access, and potentially T1552.004: Unsecured Credentials if viewed as a method for acquiring plaintext secrets. The ability of low-privileged users to extract high-value secrets indicates a fundamental design flaw in the authentication and authorization logic of the web management interface.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Immediately, MBS-Solutions should release a firmware update that restricts access to the opcua-configuration endpoint exclusively to administrators with elevated privileges who require such information for maintenance purposes. Additionally, the API response logic must be updated to mask or omit sensitive fields such as passwords and private keys before serialization into JSON responses. For organizations currently running vulnerable versions of this firmware, it is critical to rotate all OPC-UA credentials immediately after applying any available patches. Network segmentation should also be enforced to ensure that even if an attacker compromises a low-privileged account on the management interface, they cannot easily exploit these credentials against other parts of the industrial network without additional lateral movement steps. Regular security audits and penetration testing focused on API access controls are recommended to identify similar misconfigurations in other endpoints within the gateway's web server infrastructure.