CVE-2026-75162: n/a

This vulnerability exists in the opcua-configuration method of the /cgi-bin/wwwugw.cgi endpoint in MBS-Solutions X-Serie Gateway firmware version V6_00_05. Remote authenticated users, even with low privileges, can exploit this flaw to obtain configured OPC-UA authentication credentials in cleartext through the JSON API response. The flaw constitutes an information disclosure issue (CWE-200) and does not require user interaction. The attack vector is network-based with low attack complexity and privileges required.

The vulnerability allows unauthorized disclosure of sensitive OPC-UA authentication credentials to any remote authenticated user, including those with minimal privileges. This exposure could facilitate further unauthorized access or lateral movement within the affected environment. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the affected API endpoint to trusted users only and consider additional access controls to limit exposure of sensitive configuration data.