CVE-2026-75162: MBS-Solutions Gateway Info Disclosure Flaw

CVE-2026-75162 Overview

CVE-2026-75162 is an information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in the MBS-Solutions X-Serie Gateway firmware V6_00_05. The endpoint returns configured OPC-UA authentication credentials in cleartext through its JSON API response. Any authenticated user, including accounts holding the low-privileged Standard role, can retrieve these credentials. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Exposed OPC-UA credentials allow attackers to pivot into industrial control system (ICS) endpoints served by the gateway.

Critical Impact
Low-privileged remote users can extract cleartext OPC-UA credentials from the gateway API, enabling lateral movement into connected OT assets.

Affected Products

MBS-Solutions X-Serie Gateway firmware version V6_00_05
MBS-Solutions X-Serie Gateway devices exposing the /cgi-bin/wwwugw.cgi interface
Deployments where the Standard role is provisioned to non-administrative users

Discovery Timeline

2026-09-04 - CVE-2026-75162 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75162

Vulnerability Analysis

The MBS-Solutions X-Serie Gateway exposes a web management interface implemented in /cgi-bin/wwwugw.cgi. One of its JSON-based methods, opcua-configuration, returns the full OPC-UA client and server configuration to any authenticated caller. The response includes the plaintext username and password used by the gateway to authenticate to OPC-UA endpoints. Access control on this method only checks that the user is authenticated, not that the user holds administrative privileges. As a result, a Standard-role account can request the configuration and read credentials that were intended for administrators only.

Root Cause

The root cause is missing authorization enforcement on a sensitive management method combined with cleartext storage or retrieval of secrets. The opcua-configuration handler does not scope the response to the caller's role, and the JSON payload includes credential fields rather than redacting them or returning opaque handles. This pattern is a textbook case of [CWE-200] where sensitive data crosses a trust boundary that should have filtered it.

Attack Vector

Exploitation requires network access to the gateway management interface and valid credentials for any account, including the low-privileged Standard role. The attacker issues an authenticated HTTP request to the opcua-configuration method of /cgi-bin/wwwugw.cgi and parses the returned JSON to extract the username and password fields. The recovered OPC-UA credentials can then be used against the OPC-UA server the gateway communicates with, allowing the attacker to read process data, alter setpoints, or interfere with operational technology (OT) workflows. Additional technical details and a proof-of-concept are documented in the GitHub vulnerability research repository for CVE-2026-75162.

Detection Methods for CVE-2026-75162

Indicators of Compromise

HTTP requests from Standard-role users targeting the opcua-configuration method of /cgi-bin/wwwugw.cgi.
JSON responses from wwwugw.cgi containing OPC-UA username and password fields returned to non-administrative sessions.
Successful OPC-UA authentication events originating from IP addresses that do not match the gateway or approved engineering workstations.

Detection Strategies

Enable verbose access logging on the gateway web server and alert on any invocation of opcua-configuration by accounts without administrator role.
Inspect north-south traffic to the gateway for HTTP responses containing OPC-UA credential field names, using TLS termination or a monitoring appliance where feasible.
Correlate authenticated web sessions on the gateway with subsequent OPC-UA logons to detect credential reuse from unexpected hosts.

Monitoring Recommendations

Baseline which user accounts legitimately access OPC-UA configuration and alert on deviations.
Forward gateway and OPC-UA server logs to a centralized analytics platform for cross-source correlation.
Monitor for new or unexpected Standard-role account creation on the X-Serie Gateway management interface.

How to Mitigate CVE-2026-75162

Immediate Actions Required

Restrict network access to the X-Serie Gateway management interface to a dedicated management VLAN or jump host.
Audit all local gateway accounts and remove or disable Standard-role users that do not require access.
Rotate any OPC-UA credentials configured on the gateway, assuming they may already be exposed.
Review OPC-UA server logs for authentication activity that predates the credential rotation.

Patch Information

No vendor advisory or fixed firmware version is referenced in the NVD entry for CVE-2026-75162 at the time of publication. Operators should contact MBS-Solutions directly for remediation guidance and monitor the MBS Solutions X-Serie product page for firmware updates superseding V6_00_05.

Workarounds

Place the gateway behind a firewall that only permits management access from trusted administrative hosts.
Enforce unique, strong OPC-UA credentials that are not reused elsewhere in the OT environment, limiting blast radius if leaked again.
Where operationally feasible, disable or restrict the Standard role until authorization is enforced on the opcua-configuration method.
Segment the OPC-UA server so that clients connecting from outside approved control networks are rejected at the network layer.

bash

# Example: restrict access to the gateway management interface with iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP