CVE-2025-41758: Universal Bacnet Router Path Traversal

CVE-2025-41758 Overview

A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint of MBS Solutions Universal BACnet Router firmware. Due to improper path validation, attackers can leverage path traversal sequences to overwrite arbitrary files on the device, potentially achieving full system compromise.

Critical Impact

This vulnerability allows authenticated attackers with low privileges to completely compromise affected BACnet router devices by overwriting critical system files, potentially leading to device takeover or disruption of building automation systems.

Affected Products

• MBS Solutions Universal BACnet Router Firmware (all versions prior to patch)
• MBS Solutions UBR-01 MK II
• MBS Solutions UBR-02
• MBS Solutions UBR-LON

Discovery Timeline

• 2026-03-09 - CVE-2025-41758 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2025-41758

Vulnerability Analysis

This vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) affects the wwupload.cgi endpoint in MBS Solutions Universal BACnet Router firmware. The endpoint fails to properly sanitize user-supplied file paths, allowing attackers to use path traversal sequences such as ../ to escape the intended upload directory.

BACnet routers are commonly deployed in building automation and industrial control system environments, making this vulnerability particularly concerning for critical infrastructure security. A successful exploit allows an attacker with low-level credentials to write arbitrary files anywhere on the device's filesystem, enabling scenarios such as overwriting configuration files, replacing executables with malicious code, or modifying startup scripts to establish persistence.

The network-accessible nature of this vulnerability means any authenticated user on the network can potentially exploit it without requiring physical access to the device.

Root Cause

The vulnerability stems from insufficient input validation in the wwupload.cgi script. The endpoint accepts user-controlled filename parameters without properly sanitizing or validating them against path traversal sequences. When processing upload requests, the application fails to normalize file paths or restrict writes to a designated safe directory, allowing attackers to traverse the filesystem using relative path components.

Attack Vector

The attack is executed remotely over the network against the CGI endpoint. An attacker with valid low-privileged credentials can craft a malicious HTTP request to the wwupload.cgi endpoint containing path traversal sequences (e.g., ../../) in the filename parameter. This allows the attacker to specify an arbitrary location on the device's filesystem where the uploaded file content will be written.

The vulnerability mechanism involves manipulating the filename parameter in upload requests to include directory traversal sequences. When the CGI handler processes the request, it concatenates the user-supplied path with the base upload directory without proper sanitization, resulting in writes to unintended locations. Technical details are available in the MBS Solutions Security Advisory.

Detection Methods for CVE-2025-41758

Indicators of Compromise

• HTTP requests to /wwupload.cgi containing path traversal sequences such as ../, ..%2f, or ..%5c
• Unexpected file modifications in system directories including /etc/, /bin/, or configuration directories
• Anomalous write activity to files outside the designated upload directory
• Authentication logs showing low-privileged accounts accessing upload functionality

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in HTTP requests targeting wwupload.cgi
• Deploy network intrusion detection signatures for HTTP requests containing encoded or plaintext directory traversal sequences
• Configure file integrity monitoring (FIM) on critical system files and directories to detect unauthorized modifications
• Review CGI access logs for requests containing suspicious path patterns or unusual file extension combinations

Monitoring Recommendations

• Enable verbose logging on BACnet router devices and forward logs to a centralized SIEM for analysis
• Monitor for failed and successful authentication attempts followed by upload activity
• Set up alerts for any HTTP 200 responses to requests containing traversal patterns
• Implement baseline monitoring for file system changes on affected devices

How to Mitigate CVE-2025-41758

Immediate Actions Required

• Apply the latest firmware update from MBS Solutions as referenced in security advisory MBS-2025-0001
• Restrict network access to BACnet router management interfaces using firewall rules and network segmentation
• Review and audit all user accounts with access to affected devices, removing unnecessary privileges
• Implement additional authentication controls or move management interfaces to isolated network segments

Patch Information

MBS Solutions has released a security advisory addressing this vulnerability. Administrators should obtain the patched firmware version from the MBS Solutions Security Advisory and apply it to all affected UBR-01 MK II, UBR-02, and UBR-LON devices. Verify firmware integrity after download and plan maintenance windows for deployment in production environments.

Workarounds

• Restrict access to the wwupload.cgi endpoint using web server access controls or reverse proxy rules
• Implement network segmentation to isolate BACnet router management interfaces from untrusted networks
• Deploy a web application firewall (WAF) in front of affected devices configured to block path traversal attempts
• Temporarily disable the upload functionality if not required for operations until patching can be completed

# Example: Restrict access to upload endpoint via iptables (if applicable)
# Limit access to management interface to specific trusted IP ranges
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP