CVE-2026-75166: X-Serie Gateway Privilege Escalation

CVE-2026-75166 Overview

CVE-2026-75166 is an insecure permission vulnerability in MBS-Solutions X-Serie Gateway firmware version V6_00_05. The firmware allows a low-privileged service user to execute /usr/bin/tcpdump as root without providing a password. An authenticated attacker can abuse the tcpdump -z postrotate option to run arbitrary commands as root. The flaw is classified under CWE-269: Improper Privilege Management and yields full compromise of the gateway operating system.

Critical Impact
An authenticated low-privileged user can escalate to root and gain full control of the affected MBS-Solutions X-Serie Gateway, exposing network traffic and downstream operational technology assets.

Affected Products

MBS-Solutions X-Serie Gateway firmware V6_00_05
See the MBS XSerie Product Page for device variants running the affected firmware
Additional product context on the MBS Solutions Homepage

Discovery Timeline

2026-09-04 - CVE-2026-75166 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75166

Vulnerability Analysis

The X-Serie Gateway firmware ships with a sudoers configuration that grants the low-privileged service account permission to run /usr/bin/tcpdump as root without password authentication. tcpdump is a packet capture utility that exposes a documented -z postrotate-command flag intended to invoke a helper program after each rotated capture file. When tcpdump runs with root privileges, the postrotate command inherits those privileges.

An authenticated attacker who reaches the service user context can call sudo tcpdump with a rotation interval and a -z argument that points to an attacker-controlled binary or shell command. The result is arbitrary command execution as root on the gateway. Full compromise of the device follows, including access to captured packet data, credentials, and lateral movement paths into connected industrial networks.

Root Cause

The root cause is improper privilege management [CWE-269]. The vendor granted NOPASSWD sudo rights to a binary that supports invoking arbitrary child processes. tcpdump is a well-documented sudo-unsafe binary and appears in public privilege-escalation reference material such as GTFOBins. Restricting sudo to tcpdump without argument filtering effectively equates to granting the account full root shell access.

Attack Vector

The attacker requires low-privileged authenticated access to the gateway, for example through a shell as the service user or via any interface that pipes commands to that account. Once authenticated, the attacker invokes sudo /usr/bin/tcpdump with -Z root, a small rotation size using -C, a rotation trigger using -G, a capture file path with -w, and a -z postrotate command pointing to a script that spawns a root shell or executes commands. After the first rotation, the postrotate command runs as root. Additional exploitation details are available in the GitHub CVE-2026-75166 Research repository.

Detection Methods for CVE-2026-75166

Indicators of Compromise

Execution of tcpdump via sudo by the low-privileged service account, particularly with the -z or -Z flags present in command arguments
Unexpected child processes of tcpdump running with uid=0, such as sh, bash, nc, python, or scripts in world-writable directories
New or modified files under /tmp, /var/tmp, or the service user home directory that are referenced by tcpdump -z arguments
Capture files (.pcap) written to unusual paths shortly before privilege escalation activity

Detection Strategies

Alert on any process ancestry where tcpdump spawns an interactive shell or interpreter as root
Parse sudo audit logs (/var/log/auth.log, /var/log/secure) for entries invoking tcpdump with -z postrotate arguments
Baseline legitimate tcpdump usage on the gateway and treat deviations, especially from non-administrator accounts, as high priority
Correlate rapid capture-file rotation with subsequent root-context command execution

Monitoring Recommendations

Forward gateway syslog, sudo, and process telemetry to a centralized SIEM or data lake for retention and correlation
Monitor /etc/sudoers and /etc/sudoers.d/ for unauthorized modifications that add NOPASSWD entries
Track authentication events for the service account and flag interactive sessions from unexpected source addresses

How to Mitigate CVE-2026-75166

Immediate Actions Required

Restrict network access to the X-Serie Gateway management and service interfaces to trusted administrative networks only
Rotate credentials for the affected service account and disable interactive login where possible
Remove or tighten the sudoers entry that permits NOPASSWD execution of /usr/bin/tcpdump by the service user
Audit gateway hosts for evidence of prior tcpdump -z abuse before applying containment

Patch Information

At the time of publication, no vendor patch reference is listed in the NVD entry for CVE-2026-75166. Consult the MBS Solutions Homepage and contact the vendor directly for firmware updates that address the insecure sudoers configuration on X-Serie Gateway V6_00_05.

Workarounds

Remove the NOPASSWD sudo rule for /usr/bin/tcpdump and require full password authentication for privileged capture operations
Replace direct tcpdump access with a wrapper script that validates arguments and rejects the -z and -Z flags
Constrain packet capture to administrator accounts and remove the service user from any group with capture privileges
Apply Linux capabilities (cap_net_raw, cap_net_admin) to a dedicated non-root capture binary instead of granting root via sudo

bash

# Example sudoers hardening: remove the vulnerable entry and enforce password prompt
# Edit with: visudo -f /etc/sudoers.d/xserie

# Remove or comment out any line resembling:
# service ALL=(root) NOPASSWD: /usr/bin/tcpdump

# Replace with an administrator-only, password-required rule:
admin ALL=(root) /usr/bin/tcpdump

# Optional: grant capture capability to a restricted binary instead of using sudo
setcap cap_net_raw,cap_net_admin=eip /usr/local/bin/tcpdump-restricted
chown root:netcapture /usr/local/bin/tcpdump-restricted
chmod 750 /usr/local/bin/tcpdump-restricted