CVE-2025-41754: Universal BACnet Router Information Leak

CVE-2025-41754 Overview

CVE-2025-41754 is an arbitrary file read vulnerability affecting MBS Solutions Universal BACnet Router firmware. A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint, to read arbitrary files on the system. This vulnerability poses a significant risk to building automation systems and industrial control environments where these BACnet routers are deployed.

Critical Impact

Attackers with low-privilege network access can read sensitive configuration files, credentials, and system data from affected BACnet router devices, potentially enabling further attacks on building automation and industrial control systems.

Affected Products

• MBS Solutions Universal BACnet Router Firmware (all versions)
• MBS Solutions UBR-01 MK II
• MBS Solutions UBR-02
• MBS Solutions UBR-LON

Discovery Timeline

• 2026-03-09 - CVE-2025-41754 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2025-41754

Vulnerability Analysis

This vulnerability exists in the web management interface of MBS Solutions Universal BACnet Router devices. The wwwubr.cgi component contains an undocumented API endpoint called ubr-editfile that fails to properly validate or restrict file access requests. Although this endpoint appears to be unused in normal operations, it remains accessible to authenticated users with low privileges, creating an exploitable path traversal condition.

The vulnerability is classified under CWE-1242, which relates to inclusion of undocumented features or chicken bits that can be exploited by attackers. The network-accessible nature of this flaw means any authenticated user on the network can leverage this endpoint to extract sensitive system files without requiring administrative privileges.

Root Cause

The root cause of CVE-2025-41754 is the presence of an undocumented and improperly secured API endpoint (ubr-editfile) within the wwwubr.cgi web interface component. This endpoint was likely included during development or for debugging purposes but was never removed or properly secured before production deployment. The endpoint lacks adequate access controls and input validation, allowing authenticated users to specify arbitrary file paths for reading.

Attack Vector

The attack is network-based and requires low-privilege authentication to the target device. An attacker who has obtained valid credentials (even with minimal privileges) can send specially crafted HTTP requests to the wwwubr.cgi endpoint, invoking the ubr-editfile method with manipulated file path parameters. This allows reading of arbitrary files from the device filesystem, including sensitive configuration files, credential stores, and system information.

The vulnerability mechanism involves:

1. Authentication to the BACnet router web interface with any valid credentials
2. Sending a request to the wwwubr.cgi endpoint targeting the ubr-editfile method
3. Manipulating the file path parameter to specify arbitrary system files
4. Receiving the contents of the requested file in the HTTP response

For technical details on exploitation methods, refer to the MBS Solutions Security Advisory.

Detection Methods for CVE-2025-41754

Indicators of Compromise

• Unusual HTTP requests to wwwubr.cgi containing the ubr-editfile method parameter
• Access logs showing requests for sensitive system files such as /etc/passwd, /etc/shadow, or configuration files
• Multiple file read attempts from a single authenticated session targeting different system paths
• Requests containing path traversal sequences (e.g., ../) in conjunction with the ubr-editfile endpoint

Detection Strategies

• Monitor web server access logs on BACnet router devices for requests targeting wwwubr.cgi with ubr-editfile parameters
• Implement network intrusion detection rules to alert on HTTP traffic patterns indicative of arbitrary file read attempts
• Deploy SentinelOne Singularity to detect anomalous process behavior and file access patterns on network-accessible embedded devices
• Audit authentication logs for accounts accessing the web management interface and correlate with suspicious file read activity

Monitoring Recommendations

• Enable verbose logging on MBS Solutions BACnet router web interfaces and forward logs to a SIEM platform
• Configure network monitoring to baseline normal traffic patterns to BACnet routers and alert on deviations
• Implement file integrity monitoring on critical configuration files where supported by the device firmware
• Review and audit user accounts with access to the router management interface regularly

How to Mitigate CVE-2025-41754

Immediate Actions Required

• Apply firmware updates from MBS Solutions as soon as they become available
• Restrict network access to the web management interface using firewall rules or network segmentation
• Review and minimize the number of user accounts with access to router management interfaces
• Monitor access logs for any signs of exploitation attempts targeting the ubr-editfile endpoint
• Consider disabling the web management interface entirely if not required for operations

Patch Information

MBS Solutions has published a security advisory addressing this vulnerability. Administrators should consult the MBS Solutions Security Advisory for specific firmware update instructions and patch availability for affected devices. Apply the recommended firmware update to all deployed UBR-01 MK II, UBR-02, and UBR-LON devices.

Workarounds

• Implement network segmentation to isolate BACnet router devices from general network access
• Use firewall rules to restrict access to the web management interface (typically port 80/443) to only trusted management stations
• Enable strong authentication and use unique, complex passwords for all user accounts on the device
• If possible, disable the web interface and use alternative management methods until patches are applied
• Deploy a web application firewall (WAF) in front of the management interface to filter malicious requests targeting the ubr-editfile endpoint

Network segmentation is critical for building automation and industrial control environments. The following example demonstrates restricting management interface access using iptables on a Linux-based firewall:

# Configuration example
# Restrict access to BACnet router management interface
# Allow only trusted management subnet (192.168.10.0/24) to access router web interface
iptables -A FORWARD -s 192.168.10.0/24 -d 192.168.20.50 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 192.168.10.0/24 -d 192.168.20.50 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.168.20.50 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.20.50 -p tcp --dport 443 -j DROP