Description

An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T16:17:58.330Z",
  "pubdate": "2026-09-04T16:17:58.330Z",
  "executiveSummary": "The MBS-Solutions X-Serie Gateway firmware version V6_00_05 is susceptible to an arbitrary file read vulnerability located within the /cgi-bin/ugwdownload.cgi script.\nThis vulnerability is classified as an improper input validation flaw, allowing a remote attacker to bypass intended file access restrictions.\nExploitation of this vulnerability requires the attacker to possess authenticated access to the device with a low-privileged 'Standard' user role.\nThe successful execution of this attack permits the unauthorized retrieval of arbitrary files from the underlying device filesystem.\nThis represents a significant security risk, as an attacker could potentially exfiltrate sensitive configuration files, credentials, cryptographic keys, or system logs, leading to full system compromise or lateral movement within the network.\nThe vulnerability highlights a failure in the application's sanitization logic, as it fails to properly validate the 'file' query string parameter provided to the CGI interface.\nGiven the nature of the gateway device, this flaw could be leveraged to gain deep visibility into the network infrastructure managed by the affected hardware.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of the 'file' query string parameter within the /cgi-bin/ugwdownload.cgi component.\nThe application processes this parameter to facilitate the download of specific files from the filesystem without implementing adequate path traversal protections or directory restriction checks.\nWhen a request is submitted to the CGI binary, the application logic fails to canonicalize the input or verify if the requested path resides within an intended, restricted directory.\nAn authenticated user with a 'Standard' role can craft a malicious HTTP GET request targeting /cgi-bin/ugwdownload.cgi and pass a system path as the value for the 'file' parameter. For example, by specifying a path such as /etc/passwd or other sensitive configuration files, the application logic resolves the request and returns the contents of the target file in the HTTP response body.\nBecause the CGI interface performs this operation with the privileges of the web server process, it effectively acts as a proxy for arbitrary file access across the local filesystem.\nThe attack flow follows a sequential path: First, the attacker establishes a valid session authenticated as a 'Standard' user. Second, the attacker performs a crafted HTTP GET request to /cgi-bin/ugwdownload.cgi?file=[target_path]. Third, the backend script parses the user-supplied input without sanitization and passes it to the underlying system read operation. Finally, the server streams the file contents back to the attacker's browser or client.\nThis flaw effectively bypasses the Principle of Least Privilege, as the application logic assumes that any input provided through the interface is inherently trusted or already constrained. The lack of validation on the 'file' parameter allows for directory traversal, meaning an attacker can navigate outside of intended web directories to read sensitive OS files, system configuration files, and application-specific settings.\nImpact includes information disclosure of critical credentials, such as hashed passwords stored in /etc/shadow or configuration files containing administrative tokens. This level of access significantly lowers the bar for subsequent escalation of privilege attacks or complete device takeover."
}