CVE-2026-75167

Name of the Vulnerable Software and Affected Versions MBS-Solutions X-Serie Gateway version V6 00 05

Description A broken access control issue exists in the /cgi-bin/wwwugw.cgi endpoint. A remote authenticated user with the low-privileged Standard role can exploit the ugw-usr-edit method to change the password of arbitrary accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /cgi-bin/wwwugw.cgi endpoint or the ugw-usr-edit method.