CVE-2026-35080 Overview
CVE-2026-35080 is an arbitrary file deletion vulnerability in the ugw-restoreinfo method. The flaw allows a remote authenticated attacker with user-level privileges to delete arbitrary local files on the affected system. The root cause is insufficient validation of user-controlled input passed to the method, classified under [CWE-73] (External Control of File Name or Path). The vulnerability was published through a CERT-VDE security advisory, indicating an industrial or operational technology context.
Critical Impact
An authenticated remote attacker can delete arbitrary files on the affected device, leading to integrity loss, configuration tampering, and denial of service.
Affected Products
- Products exposing the ugw-restoreinfo method (see CERT-VDE advisory VDE-2026-039 for the authoritative product list)
- Specific vendor and version information was not enumerated in the NVD record at publication
- Refer to the CERT-VDE Security Advisory for affected component identifiers
Discovery Timeline
- 2026-06-03 - CVE-2026-35080 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-35080
Vulnerability Analysis
The ugw-restoreinfo method exposes a file-handling routine that accepts user-controlled input to identify the resource targeted by the restore operation. The method does not sufficiently validate or sanitize the supplied path before performing file operations. An authenticated attacker with low-privilege user credentials can supply crafted input that resolves to file paths outside the intended directory scope. The result is unauthorized deletion of arbitrary files accessible to the process running the method.
The impact concentrates on integrity and availability. Deletion of configuration files, certificates, runtime data, or system binaries can render the device inoperable or alter trusted state. On embedded and industrial systems, loss of integrity for configuration data can require physical recovery procedures.
Root Cause
The defect is classified as [CWE-73]: External Control of File Name or Path. The ugw-restoreinfo handler trusts caller-supplied path information without enforcing canonicalization, allow-listing, or directory containment checks. Path traversal sequences and absolute paths are accepted by the underlying file operation.
Attack Vector
Exploitation requires network access to the management interface and valid user-level credentials. The attacker invokes the ugw-restoreinfo method with a manipulated path parameter referencing a target file. No user interaction and no elevated privileges are required. The vulnerability description and external advisory do not include a public proof-of-concept exploit.
No verified code examples are available. Refer to the CERT-VDE Security Advisory for technical details specific to the affected component.
Detection Methods for CVE-2026-35080
Indicators of Compromise
- Unexpected invocations of the ugw-restoreinfo method in management interface logs, particularly from low-privilege user accounts
- Missing configuration, certificate, or system files that were present prior to the suspicious activity
- Path parameters containing traversal sequences such as ../ or absolute paths in request payloads to the management API
Detection Strategies
- Inspect API and management interface logs for calls to ugw-restoreinfo and correlate with subsequent file-system anomalies
- Establish file integrity monitoring on configuration directories and audit deletion events with originating process and user context
- Alert on authenticated sessions issuing unusual administrative method calls outside normal operator workflows
Monitoring Recommendations
- Forward device management logs and file integrity events to a centralized SIEM for correlation
- Baseline normal ugw-restoreinfo usage patterns and alert on deviations in frequency, source, or parameter content
- Monitor authentication telemetry for low-privilege accounts performing privileged or destructive operations
How to Mitigate CVE-2026-35080
Immediate Actions Required
- Restrict network access to the management interface to trusted administrative networks only
- Review and reduce the number of accounts with user-level access to the affected method
- Audit recent invocations of ugw-restoreinfo for unauthorized usage
Patch Information
Consult the CERT-VDE Security Advisory VDE-2026-039 for vendor-supplied fixed firmware or software versions. Apply the vendor patch as soon as it is available for the deployed product version.
Workarounds
- Place the management interface behind a network segmentation boundary or VPN to limit reachability
- Enforce strong authentication and rotate credentials for accounts authorized to access the management interface
- Disable or block access to the ugw-restoreinfo method through upstream access control where the platform allows method-level filtering
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
