CVE-2025-41766

A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise.

Score

CVSS 3.1 8.8 High

Status

Analyzed - info@cert.vde.com

Published

2026-03-09

Last modified

2026-03-09

Weaknesses

CWE-787

Affected products

• Ubr-01 Mk Ii (Mbs)
• Ubr-02 (Mbs)
• Ubr-lon (Mbs)
• Universal Bacnet Router Firmware (Mbs-solutions)

References

• https://www.mbs-solutions.de/mbs-2025-0001