An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged… (CVE-2026-75165)

The vulnerability exists in the MBS-Solutions X-Serie Gateway firmware version V6_00_05, specifically in the /cgi-bin/wwwugw.cgi endpoint. A remote authenticated user assigned the low-privileged Standard role can invoke hidden network diagnostic methods such as ugw-ping and ugw-traceroute, which are not accessible through the web UI. This unauthorized invocation allows the attacker to obtain sensitive information from the device. No CVSS score or detailed impact metrics are provided, and no patch or remediation information is available in the provided data.

An attacker with low-privileged authenticated access can leverage hidden diagnostic functions to gather sensitive network information that is not intended to be accessible at their privilege level. This could potentially aid in further network reconnaissance or attacks, but the exact nature and extent of the sensitive information exposed is not detailed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device's management interface to trusted users only and monitor for unauthorized use of diagnostic functions if possible.