FKIE_CVE-2025-41761

Vulnerability from fkie_nvd - Published: 2026-03-09 09:16 - Updated: 2026-03-11 18:27
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system access. This is due to the service account being permitted to execute certain binaries (e.g., tcpdump and ip) with sudo.
References
info@cert.vde.comhttps://www.mbs-solutions.de/mbs-2025-0001Vendor Advisory
Impacted products
Vendor Product Version
mbs-solutions universal_bacnet_router_firmware *
mbs-solutions ubr-01_mk_ii -
mbs-solutions ubr-02 -
mbs-solutions ubr-lon -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:mbs-solutions:universal_bacnet_router_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D4E2B246-5465-41DB-BD9A-1533A7508790",
              "versionEndExcluding": "6.0.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:mbs-solutions:ubr-01_mk_ii:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D812069-6738-4B82-992B-09BB239783AB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:mbs-solutions:ubr-02:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B21413DE-E1FA-4B5C-A415-F8E70D7090BF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:mbs-solutions:ubr-lon:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0C67EAC-C633-4037-B2C4-965455FFF2A0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A low\u2011privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system access. This is due to the service account being permitted to execute certain binaries (e.g., tcpdump and ip) with sudo."
    },
    {
      "lang": "es",
      "value": "Un atacante local con pocos privilegios que obtiene acceso a la cuenta de servicio UBR (p. ej., a trav\u00e9s de SSH) puede escalar privilegios para obtener acceso completo al sistema. Esto se debe a que a la cuenta de servicio se le permite ejecutar ciertos binarios (p. ej., tcpdump e ip) con sudo."
    }
  ],
  "id": "CVE-2025-41761",
  "lastModified": "2026-03-11T18:27:21.243",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "info@cert.vde.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-09T09:16:00.263",
  "references": [
    {
      "source": "info@cert.vde.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mbs-solutions.de/mbs-2025-0001"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ],
      "source": "info@cert.vde.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.