CVE-2026-75163 in Firmware
Summary
by MITRE • 09/04/2026
An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 returns detailed system version fields (operatingsystem, gatewayversion) to any authenticated user, including users with the low-privileged Standard role.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified within the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Series Gateway firmware V6_00_05 represents a classic information disclosure flaw that stems from insufficient access control mechanisms on sensitive system endpoints. This specific CGI script, which serves as an interface for retrieving device configuration and status data, fails to enforce strict role-based permissions when handling requests related to device identification. Consequently, the endpoint exposes detailed internal versioning fields, specifically operating system identifiers and gateway software versions, to any user who has successfully authenticated with a Standard or low-privileged account. This behavior violates the principle of least privilege by allowing non-administrative users to access metadata that should be restricted to higher-level administrative roles responsible for maintenance and security auditing.
From a technical perspective, this flaw is categorized under CWE-200: Information Exposure, as it allows an attacker to gain insight into the internal state of the system without necessarily exploiting a code execution or memory corruption bug. The exposure occurs because the backend logic processes requests from authenticated users regardless of their privilege level when querying device information fields that are not strictly necessary for standard operational functions available to low-privileged accounts. By returning precise operating system and gateway version strings, the vulnerability provides attackers with critical intelligence regarding the specific software stack running on the target infrastructure. This data is particularly dangerous because it enables threat actors to correlate the exposed versions with known public vulnerabilities in those exact releases, effectively narrowing the scope of potential exploits from a broad search space to targeted attacks against confirmed vulnerable components.
The operational impact of this vulnerability extends beyond simple information gathering and directly facilitates further stages of an attack lifecycle as defined by the MITRE ATT&CK framework. Specifically, this aligns with T1087: Account Discovery and T1592: Gather Victim Host Information, where adversaries collect details about the target environment to plan subsequent intrusion activities. With knowledge of the exact gateway version and operating system, an attacker can search vulnerability databases such as CVE or NVD for exploits that are known to affect those specific versions. This significantly lowers the barrier to entry for attackers who might otherwise lack the expertise to identify suitable attack vectors against a generic web application interface. Furthermore, in environments where multiple devices share similar configurations, this information disclosure aids in lateral movement planning by confirming which other systems on the network may be running identical vulnerable software.
Mitigation strategies must focus on implementing robust access control checks at both the application logic and API gateway levels. The primary remediation involves modifying the ugw-deviceinfo method to verify that the requesting user possesses administrative privileges before returning sensitive versioning data. If low-privileged users require device information for monitoring purposes, the system should return generic or masked values rather than precise version strings. Additionally, developers should conduct a comprehensive audit of all CGI endpoints within the web interface to ensure consistent enforcement of role-based access control policies across all methods. Regular security testing using dynamic application security scanning tools configured with low-privileged user profiles can help identify similar discrepancies in other parts of the firmware before deployment. Keeping the gateway firmware updated is also critical, as subsequent releases may include patches that address these permission flaws or remove unnecessary exposure of internal version details entirely.