CVE-2025-41761: Universal BACnet Router Privilege Escalation

CVE-2025-41761 Overview

CVE-2025-41761 is a local privilege escalation vulnerability affecting MBS Solutions Universal BACnet Router firmware. A low-privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system access. This security flaw stems from the service account being permitted to execute certain binaries such as tcpdump and ip with sudo permissions, allowing an attacker to leverage these utilities for privilege escalation.

Critical Impact

Successful exploitation grants attackers full system access on affected BACnet router devices, potentially compromising building automation systems and industrial control networks.

Affected Products

• MBS Solutions Universal BACnet Router Firmware (all versions)
• MBS Solutions UBR-01 MK II
• MBS Solutions UBR-02
• MBS Solutions UBR-LON

Discovery Timeline

• 2026-03-09 - CVE-2025-41761 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2025-41761

Vulnerability Analysis

This vulnerability is classified under CWE-88 (Improper Neutralization of Argument Delimiters in a Command). The flaw exists in the sudoers configuration of the UBR service account, which grants elevated execution privileges for network diagnostic utilities without adequate restrictions on command arguments.

The affected devices permit the UBR service account to run utilities like tcpdump and ip with root privileges via sudo. These utilities, while essential for network diagnostics, can be abused to achieve arbitrary code execution or full system compromise when improper argument sanitization is in place.

An attacker with local access to the service account can exploit the unrestricted sudo permissions to escape intended privilege boundaries, leveraging known techniques associated with these binaries to gain root-level access on the device.

Root Cause

The root cause of CVE-2025-41761 is improper sudoers configuration that allows the UBR service account to execute privileged commands without adequate argument restrictions. The tcpdump utility, for example, supports post-rotation scripts via the -z flag, which can be abused to execute arbitrary commands as root when sudo permissions are overly permissive.

Similarly, the ip command can be leveraged through specific subcommands that allow execution of external scripts or manipulation of network namespace configurations to achieve privilege escalation.

Attack Vector

The attack requires local access to the system, typically through SSH access to the UBR service account. The attack flow involves:

1. Attacker gains access to the UBR service account through legitimate credentials, credential theft, or exploitation of other vulnerabilities
2. Attacker identifies sudo-permitted binaries by executing sudo -l
3. Attacker crafts malicious arguments for permitted utilities to achieve code execution as root
4. Attacker achieves full system compromise with root privileges

For tcpdump, an attacker could abuse the -z post-rotation command flag to execute arbitrary scripts. For the ip command, namespace operations or netns exec functionality could be leveraged to spawn privileged shells.

Detection Methods for CVE-2025-41761

Indicators of Compromise

• Unexpected sudo command executions by the UBR service account, particularly involving tcpdump with -z flag or ip netns exec commands
• Creation of unauthorized files in system directories or temporary locations with root ownership
• Anomalous shell spawning processes originating from tcpdump or ip parent processes
• SSH authentication logs showing access to the UBR service account from unexpected sources

Detection Strategies

• Monitor sudo logs (/var/log/auth.log or /var/log/secure) for suspicious command patterns executed by the UBR service account
• Implement file integrity monitoring on critical system files and directories to detect unauthorized modifications
• Deploy endpoint detection solutions to identify privilege escalation attempts and anomalous process hierarchies
• Review sudoers configuration for overly permissive entries that allow command arguments without restrictions

Monitoring Recommendations

• Enable comprehensive audit logging for all sudo command executions on affected devices
• Configure alerts for any sudo usage by service accounts that deviates from expected operational patterns
• Implement network segmentation monitoring to detect lateral movement attempts following potential compromise
• Establish baseline behavior for service account activities to identify anomalous command execution

How to Mitigate CVE-2025-41761

Immediate Actions Required

• Apply firmware updates from MBS Solutions as soon as they become available
• Restrict network access to SSH services on affected devices to authorized management networks only
• Review and harden sudoers configuration to limit command arguments for permitted binaries
• Implement strong authentication for the UBR service account and consider disabling SSH access if not required

Patch Information

MBS Solutions has published a security advisory regarding this vulnerability. Administrators should consult the MBS Solutions Security Advisory for detailed patch information and firmware update instructions.

Organizations should prioritize applying vendor-supplied patches to all affected devices, including UBR-01 MK II, UBR-02, and UBR-LON models running vulnerable firmware versions.

Workarounds

• Modify sudoers configuration to restrict command arguments for tcpdump and ip utilities, preventing abuse of dangerous flags
• Implement network-level access controls to restrict SSH access to affected devices from trusted management hosts only
• Consider disabling the UBR service account's shell access if remote administration is not required
• Deploy additional monitoring and alerting for any sudo usage on affected devices until patches can be applied

# Example: Restrict sudoers to prevent dangerous tcpdump arguments
# Replace permissive entry like:
# ubr_service ALL=(ALL) NOPASSWD: /usr/bin/tcpdump
# With a more restrictive entry:
ubr_service ALL=(ALL) NOPASSWD: /usr/bin/tcpdump -i eth0 -w /var/log/capture.pcap

# Alternatively, remove sudo permissions entirely if not operationally required
# and use dedicated network capture tools with appropriate sandboxing