CVE-2026-75167: MBS-Solutions X-Serie Gateway Privilege Escalation

CVE-2026-75167 Overview

CVE-2026-75167 is a broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05. A remote authenticated user holding only the low-privileged Standard role can change the password of arbitrary accounts, including administrative ones. This flaw enables horizontal and vertical privilege escalation without any additional exploitation primitives. Once an attacker resets an administrator password, they gain full control of the gateway device and any downstream network services it manages.

Critical Impact
A Standard-role user can hijack administrator accounts by resetting their passwords, resulting in full gateway compromise.

Affected Products

MBS-Solutions X-Serie Gateway firmware version V6_00_05
The vulnerable component is /cgi-bin/wwwugw.cgi
The vulnerable method is ugw-usr-edit

Discovery Timeline

2026-09-04 - CVE-2026-75167 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75167

Vulnerability Analysis

The vulnerability resides in the ugw-usr-edit handler exposed by /cgi-bin/wwwugw.cgi in the X-Serie Gateway web management interface. The handler accepts password modification requests but fails to verify whether the requesting user is authorized to modify the target account. Any authenticated session, including one bound to the Standard role, can therefore issue a password change against any user record stored on the device.

Because the gateway uses role-based accounts to gate administrative functions, resetting an administrator password directly bypasses those role boundaries. The attacker converts limited web access into full administrative access with a single request. This class of flaw is categorized as broken access control and specifically as a missing authorization check on a privileged operation.

Root Cause

The root cause is a missing server-side authorization check in the ugw-usr-edit method. The endpoint validates that the caller is authenticated but does not confirm that the caller either owns the target account or holds an administrative role. Authorization is treated as equivalent to authentication, which is the defining pattern of broken access control.

Attack Vector

An attacker first obtains or is issued Standard-role credentials on the gateway. The attacker then authenticates to the web interface and submits a crafted request to /cgi-bin/wwwugw.cgi invoking the ugw-usr-edit method with a target username and a new password. The server processes the change without a role check, and the attacker logs in as the targeted account.

Technical details and reproduction notes are documented in the GitHub CVE-2026-75167 Research repository. Product context for the affected device family is available on the MBS X-Series Information page.

Detection Methods for CVE-2026-75167

Indicators of Compromise

HTTP POST requests to /cgi-bin/wwwugw.cgi containing the ugw-usr-edit method parameter originating from non-administrative user sessions.
Password change events on administrative accounts that are not preceded by an administrator login from a known workstation.
Successful administrative logins from source IP addresses that previously authenticated only as Standard-role users.

Detection Strategies

Enable verbose access logging on the gateway web server and alert on any ugw-usr-edit invocation whose session role is not administrator.
Correlate account modification events with the role of the initiating session to flag privilege boundary violations.
Baseline normal administrative activity and alert on off-hours password resets against privileged accounts.

Monitoring Recommendations

Forward gateway CGI access logs and authentication events to a centralized log platform for retention and correlation.
Monitor for repeated failed logins followed by a successful login on the same account, which can indicate a post-reset takeover.
Track configuration changes on the X-Serie Gateway and require an out-of-band review for any administrator account modification.

How to Mitigate CVE-2026-75167

Immediate Actions Required

Restrict management interface exposure to trusted administrative networks and block internet-facing access to /cgi-bin/wwwugw.cgi.
Rotate all account passwords on affected X-Serie Gateway devices, starting with administrator accounts, and audit the user list for unexpected entries.
Review authentication logs for evidence of unauthorized password changes performed via the ugw-usr-edit method.

Patch Information

No vendor patch reference is listed in the NVD entry for CVE-2026-75167 at the time of publication. Administrators should consult the MBS Solutions Overview page and contact the vendor for firmware updates addressing the ugw-usr-edit authorization gap in firmware V6_00_05.

Workarounds

Place the gateway management interface behind a VPN or jump host and enforce network-layer access control lists that only permit administrative IPs.
Reduce the number of Standard-role accounts on the device and remove any account that does not require web management access.
If feasible, disable remote management on the affected devices until a vendor-supplied fix is installed and verified.

bash

# Example: restrict access to the gateway management interface at the network edge
iptables -A FORWARD -p tcp -d <gateway_ip> --dport 443 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <gateway_ip> --dport 443 -j DROP