An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated… (CVE-2026-75169)

The vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 involves the /cgi-bin/ugwupload.cgi component, which improperly restricts file uploads. A remote user authenticated with Admin role can exploit this to upload arbitrary files to fixed locations on the device's filesystem, potentially leading to unauthorized file placement or modification.

An attacker with Admin authentication can upload arbitrary files to predetermined paths on the gateway device. This could facilitate unauthorized code execution, persistence, or disruption of device operation depending on the nature and location of the uploaded files. No information is provided about exploitation in the wild or broader impact beyond file upload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict Admin access to trusted personnel only and monitor for suspicious file uploads. Follow vendor communications for updates on patches or mitigations.