CVE-2025-41765

critical · 9.1

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This includes, but is not limited to, contact images, HTTPS certificates, system backups for restoration, server peer configurations, and BACnet/SC server certificates and keys.

9.1

CVSS

0.3%

EPSS (exploit prob.)

19th

EPSS percentile

2026-03-09

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-862

Affected products

Vendor	Product	Affected versions
mbs-solutions	universal_bacnet_router_firmware	< 6.0.1.0
mbs-solutions	ubr-01_mk_ii	all versions
mbs-solutions	ubr-02	all versions
mbs-solutions	ubr-lon	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.mbs-solutions.de/mbs-2025-0001

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-41765