CVE-2025-41760

An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not enforce any restrictions and allows all network traffic to pass unfiltered.

Score

CVSS 3.1 4.9 Medium

Status

Analyzed - info@cert.vde.com

Published

2026-03-09

Last modified

2026-03-09

Weaknesses

CWE-636

Affected products

• Ubr-01 Mk Ii (Mbs)
• Ubr-02 (Mbs)
• Ubr-lon (Mbs)
• Universal Bacnet Router Firmware (Mbs-solutions)

References

• https://www.mbs-solutions.de/mbs-2025-0001