An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user… (CVE-2026-75168)

The vulnerability exists in the ugw-editfile method of the /cgi-bin/wwwugw.cgi endpoint in MBS-Solutions X-Serie Gateway firmware version V6_00_05. It allows a remote authenticated user with the Standard role, which is low-privileged, to write arbitrary content to files located in the /uxx/config/ and /ugw/config/ directories. This improper access control issue corresponds to CWE-284 (Improper Access Control). The vulnerability can be exploited remotely over the network without user interaction, with low attack complexity and privileges required. The impact includes limited confidentiality, integrity, and availability loss.

A remote authenticated user with low privileges can write arbitrary content to configuration files, potentially leading to unauthorized modification of device configuration, partial loss of confidentiality, integrity, and availability. The CVSS score of 6.3 reflects moderate impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided. Until a patch is available, restrict access to the affected endpoint and monitor for unauthorized changes to configuration files.