CVE-2025-41772: Universal BACnet Router Auth Bypass Flaw

CVE-2025-41772 Overview

CVE-2025-41772 is an information disclosure vulnerability affecting MBS Solutions Universal BACnet Router firmware. An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint. This vulnerability enables session hijacking attacks against industrial building automation systems, potentially allowing attackers to gain unauthorized access to network routing infrastructure.

Critical Impact

Session tokens transmitted in URL parameters can be captured through browser history, server logs, referrer headers, and network monitoring, enabling complete session hijacking without authentication.

Affected Products

• MBS Solutions Universal BACnet Router Firmware
• MBS Solutions UBR-01 MK II
• MBS Solutions UBR-02
• MBS Solutions UBR-LON

Discovery Timeline

• 2026-03-09 - CVE-2025-41772 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2025-41772

Vulnerability Analysis

This vulnerability falls under CWE-598 (Use of GET Request Method With Sensitive Query Strings), which describes a weakness where sensitive information is transmitted via URL parameters rather than through secure channels like POST bodies or headers. In the context of the MBS Solutions Universal BACnet Router firmware, session tokens are improperly included in plaintext within the URL parameters when requests are made to the wwwupdate.cgi endpoint.

The exposure of session tokens through URL parameters creates multiple attack surfaces. These tokens may be logged in web server access logs, proxy server logs, browser history, and can be leaked through the HTTP Referer header when navigating to external sites. An attacker with access to any of these logging mechanisms can harvest valid session tokens without requiring any authentication.

BACnet routers are commonly deployed in building automation systems (BAS) for HVAC control, lighting systems, and security infrastructure. Unauthorized access to these devices could allow attackers to manipulate building controls, disrupt operations, or use the compromised device as a pivot point for lateral movement within operational technology (OT) networks.

Root Cause

The root cause of this vulnerability is improper handling of session management in the wwwupdate.cgi endpoint. The application transmits session tokens as GET request parameters instead of utilizing secure transmission methods such as HTTP headers, cookies with appropriate security flags, or POST request bodies. This design flaw violates secure coding practices that mandate sensitive data should never be included in URL query strings.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can intercept session tokens through several methods:

1. Network Monitoring: Passive interception of HTTP traffic containing session tokens in URLs
2. Log Access: Accessing web server logs, proxy logs, or shared hosting environments where URLs are logged
3. Browser History/Cache: Physical access to systems that have accessed the vulnerable endpoint
4. Referrer Header Leakage: Session tokens leaked to third-party sites through HTTP Referer headers

Once a valid session token is obtained, the attacker can hijack the authenticated session and perform actions as the legitimate user, potentially including firmware updates, configuration changes, and network routing modifications.

The vulnerability requires network-accessible exposure of the device's web interface. Organizations that have properly segmented their OT networks and restricted access to management interfaces have reduced exposure to this vulnerability.

Detection Methods for CVE-2025-41772

Indicators of Compromise

• Unusual access patterns to the wwwupdate.cgi endpoint from unexpected IP addresses
• Multiple session token values appearing in web server access logs for the same user
• Concurrent sessions from geographically disparate locations
• Anomalous administrative actions on BACnet router configuration

Detection Strategies

• Monitor HTTP access logs for requests to wwwupdate.cgi containing session parameters from external or unauthorized IP ranges
• Implement network traffic analysis to identify session token patterns in URL parameters crossing network boundaries
• Deploy intrusion detection signatures to alert on suspicious access to the vulnerable endpoint
• Correlate authentication events with subsequent session usage to identify token reuse from different sources

Monitoring Recommendations

• Enable verbose logging on all MBS Solutions Universal BACnet Router devices
• Implement centralized log collection for BACnet router access logs with retention for forensic analysis
• Configure network monitoring solutions to alert on any external access attempts to device management interfaces
• Establish baseline behavior for device administration access and alert on deviations

How to Mitigate CVE-2025-41772

Immediate Actions Required

• Restrict network access to the management interface of affected devices to authorized IP addresses only
• Place affected devices behind a firewall with strict access control lists
• Implement network segmentation to isolate building automation systems from general network traffic
• Review access logs for any signs of exploitation or unauthorized session access

Patch Information

MBS Solutions has released a security advisory addressing this vulnerability. Administrators should consult the MBS Solutions Security Advisory for specific patch information and updated firmware versions. Apply all available security updates to affected Universal BACnet Router devices as soon as possible after appropriate testing in a non-production environment.

Workarounds

• Implement a reverse proxy or web application firewall (WAF) in front of the device management interface to filter and sanitize requests
• Disable external access to the wwwupdate.cgi endpoint until patches are applied
• Use VPN connections for all remote management access to BACnet router devices
• Consider implementing additional authentication layers such as client certificates where supported
• Enable HTTPS to encrypt traffic and reduce plaintext interception risks, though this does not fully mitigate the URL exposure issue

# Example firewall configuration to restrict management interface access
# Allow only trusted management subnet to access web interface
iptables -A INPUT -p tcp --dport 80 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP