An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05… (CVE-2026-75162)

The vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 involves the opcua-configuration method accessible through /cgi-bin/wwwugw.cgi. Remote authenticated users with low privileges can exploit this flaw to obtain configured OPC-UA authentication credentials in cleartext from the JSON API response. This exposure of sensitive credentials could potentially lead to further unauthorized access or compromise of the OPC-UA service. No CVSS score or detailed impact metrics are provided, and no patch or vendor advisory information is available.

The impact is the disclosure of sensitive OPC-UA authentication credentials to any remote authenticated user, including those with minimal privileges. This could facilitate unauthorized access to the OPC-UA service or related systems relying on these credentials. There is no information about active exploitation in the wild or additional consequences beyond credential disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict access to the affected API endpoint to trusted users only and consider additional monitoring of authentication-related activities. Avoid using low-privileged accounts for sensitive operations until a fix is available.