CVE-2026-75167 in Firmware
Summary
by MITRE • 09/04/2026
A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified involves a critical broken access control flaw within the ugw-usr-edit method located in the /cgi-bin/wwwugw.cgi script, specifically affecting MBS-Solutions X-Series Gateway firmware version V6_00_05 and potentially other versions with similar configurations. This issue stems from an insufficient authorization check during password modification operations. While the system correctly restricts many administrative functions to high-privileged users, it fails to validate whether a user holding only the Standard role has the authority to modify credentials for accounts beyond their own profile or designated scope. Consequently, any authenticated user with low-level privileges can exploit this logic error to alter passwords of arbitrary accounts on the gateway device. This represents a significant deviation from the principle of least privilege and indicates that the application relies heavily on client-side checks or lacks robust server-side validation of role-based access control policies during sensitive state-changing operations.
From a technical perspective, the flaw resides in how the web interface processes requests to update user credentials. When a request is sent to edit a user account, the backend logic likely accepts parameters specifying the target username and new password without verifying if the requesting session possesses the necessary administrative rights for that specific action. In secure implementations, such operations should be gated by explicit checks ensuring the requester matches the owner of the account or holds an administrator role capable of managing other users. The absence of this check allows a malicious actor to craft HTTP requests targeting any valid username on the system, effectively bypassing intended security boundaries. This type of vulnerability is commonly categorized under CWE-269 Improper Privilege Management and more specifically aligns with CWE-862 Missing Authorization, as the application fails to enforce proper access controls for authorized actions.
The operational impact of this vulnerability is severe due to its potential for lateral movement and privilege escalation within managed networks. An attacker who has obtained low-level credentials through phishing, credential stuffing, or other initial compromise vectors can leverage this flaw to take control of high-privileged administrative accounts. By changing the password of an administrator account, the attacker gains full access to the gateway’s configuration interface, allowing them to modify network settings, intercept traffic, disable security logging, or install persistent backdoors. This capability effectively neutralizes many perimeter defenses since the gateway often serves as a critical choke point for network segmentation and policy enforcement. Furthermore, if multiple devices are managed centrally, compromising one device could facilitate broader attacks across the infrastructure depending on shared credential practices.
This vulnerability maps directly to several techniques in the MITRE ATT&CK framework, particularly T1078 Valid Accounts, where attackers use legitimate credentials to gain access, followed by T1098 Account Manipulation, which involves adding or modifying accounts to maintain persistence and expand access. The ability to change passwords arbitrarily also facilitates T1534 Internal Spearphishing if the attacker uses compromised administrative credentials to target other users within the organization. Additionally, because this is a web-based interface vulnerability, it falls under T1190 Exploit Public-Facing Application, assuming the gateway is accessible from untrusted networks or has exposed management interfaces without adequate network-level restrictions.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is to apply the latest firmware updates provided by MBS-Solutions that patch this specific authorization logic error in the wwwugw.cgi script. If an update is not immediately available, administrators should implement strict network segmentation rules to ensure that the management interface of these gateways is only accessible from trusted internal subnets and never exposed directly to the internet or untrusted networks. Additionally, enforcing multi-factor authentication for all administrative accounts adds a critical layer of defense-in-depth, making it significantly harder for attackers to utilize stolen credentials even if they manage to change passwords. Regular audits of user roles and permissions should be conducted to ensure that standard users do not have unnecessary write access to sensitive configuration endpoints. Finally, implementing web application firewalls with rules targeting suspicious patterns in CGI script interactions can provide an additional layer of detection and prevention against exploitation attempts while patching efforts are underway.