CVE-2025-41763: Bacnet Router Information Disclosure Bug

CVE-2025-41763 Overview

CVE-2025-41763 is an information exposure vulnerability affecting MBS Solutions Universal BACnet Router Firmware. A low-privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators, including system backups and certificate request files. This vulnerability enables unauthorized access to sensitive configuration data and credentials that should be restricted to administrative users only.

Critical Impact

Low-privileged attackers can exfiltrate sensitive system backups and certificate files from affected BACnet routers, potentially compromising entire building automation networks.

Affected Products

• MBS Solutions Universal BACnet Router Firmware (all versions prior to patched release)
• MBS Solutions UBR-01 MK II
• MBS Solutions UBR-02
• MBS Solutions UBR-LON

Discovery Timeline

• 2026-03-09 - CVE-2025-41763 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2025-41763

Vulnerability Analysis

This vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The affected BACnet router devices contain a web management interface that improperly enforces access controls on the wwwdnload.cgi endpoint. This CGI script is designed to facilitate file downloads for administrative functions but fails to verify whether the requesting user has sufficient privileges to access the requested resources.

The vulnerability allows authenticated users with minimal privileges to bypass authorization checks and directly request sensitive files that should only be accessible to administrators. This includes system backup files that may contain network configurations, credentials, and other sensitive operational data, as well as certificate request files that could be leveraged for further attacks on the building automation infrastructure.

Root Cause

The root cause of this vulnerability is improper access control implementation in the wwwdnload.cgi endpoint. The web application authenticates users but does not properly validate authorization levels before serving file download requests. The endpoint accepts requests from any authenticated session without verifying administrative privileges, allowing low-privileged users to access resources intended only for administrators.

Attack Vector

The attack is network-based and requires only low privileges to execute. An attacker who has obtained valid low-privileged credentials (either through legitimate means or credential compromise) can craft HTTP requests to the wwwdnload.cgi endpoint to retrieve sensitive files.

The attacker can directly access the vulnerable CGI endpoint by constructing requests that specify target files such as system backups or certificate requests. Since the endpoint does not enforce proper authorization checks, the server responds with the requested file contents regardless of the user's actual privilege level. This allows extraction of sensitive configuration data, backup archives containing credentials, and PKI-related files that could facilitate additional attacks on the building automation network.

Detection Methods for CVE-2025-41763

Indicators of Compromise

• Unusual or excessive HTTP requests to the wwwdnload.cgi endpoint from non-administrative user sessions
• Log entries showing file download requests for backup files or certificate files from low-privileged accounts
• Unexpected outbound data transfers from BACnet router devices
• Access patterns indicating enumeration of available downloadable resources

Detection Strategies

• Monitor web server logs for requests to wwwdnload.cgi and correlate with user privilege levels
• Implement network traffic analysis to detect unusual file downloads from router management interfaces
• Configure alerts for backup file or certificate file access by non-administrative users
• Deploy intrusion detection signatures for known exploitation patterns targeting this endpoint

Monitoring Recommendations

• Enable verbose logging on BACnet router web management interfaces
• Implement network segmentation monitoring between building automation systems and corporate networks
• Set up SIEM rules to correlate authentication events with sensitive file access attempts
• Conduct periodic review of access logs for the management interface

How to Mitigate CVE-2025-41763

Immediate Actions Required

• Apply the security patch from MBS Solutions immediately upon availability
• Restrict network access to BACnet router management interfaces to trusted administrative networks only
• Review and audit all user accounts with access to affected devices, removing unnecessary privileges
• Implement additional network-layer access controls such as firewall rules or VPN requirements for management access

Patch Information

MBS Solutions has released a security advisory addressing this vulnerability. Administrators should consult the MBS Solutions Security Advisory for official patch information and updated firmware versions.

Workarounds

• Implement network segmentation to isolate BACnet router management interfaces from untrusted networks
• Disable or restrict access to the web management interface until patches can be applied
• Use firewall rules to limit access to the management interface to specific administrator IP addresses
• Monitor and audit all access to the wwwdnload.cgi endpoint for suspicious activity

# Example firewall rule to restrict management interface access
# Restrict access to BACnet router management port (typically 80/443) to admin subnet only
iptables -A INPUT -p tcp --dport 80 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP