An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with… (CVE-2026-75161)

The ugw-restart method in the /cgi-bin/wwwugw.cgi endpoint of MBS-Solutions X-Serie Gateway firmware version V6_00_05 contains a vulnerability that permits a remote authenticated user with low-privileged Standard role access to inject arbitrary code into the dpcheck system utility. This utility runs with root privileges, enabling potential privilege escalation. The vulnerability is identified as CVE-2026-75161. No CVSS score or detailed vendor advisory is available, and no patch information has been disclosed.

A remote authenticated user with low-privileged Standard role access can execute arbitrary code as root by exploiting the code injection vulnerability in the dpcheck system utility via the ugw-restart method. This could lead to full system compromise on affected devices. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to trusted users only and monitor for suspicious activity involving the ugw-restart method. Avoid granting unnecessary Standard role access to untrusted users.