An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05… (CVE-2026-75163)

The vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 involves the ugw-deviceinfo method of the /cgi-bin/wwwugw.cgi endpoint. It improperly exposes detailed system version fields (operatingsystem, gatewayversion) to authenticated users regardless of their privilege level, including low-privileged Standard users. This constitutes an information disclosure issue categorized under CWE-200. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

The vulnerability allows low-privileged authenticated users to access sensitive system version information. While this does not directly affect system integrity or availability, the disclosed information could aid attackers in reconnaissance and subsequent targeted attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, restrict access to the affected endpoint to trusted users only and monitor for unusual access patterns.