CVE-2026-75163: n/a

This vulnerability involves the ugw-deviceinfo method in the MBS-Solutions X-Serie Gateway firmware version V6_00_05. The method returns detailed system version fields (operatingsystem, gatewayversion) to any authenticated user, including those with low-privileged Standard roles. This constitutes an information disclosure issue classified under CWE-200. The CVSS v3.1 base score is 6.5, indicating a medium severity level, with an attack vector of network, low attack complexity, requiring low privileges, no user interaction, and impact limited to confidentiality.

An attacker with any authenticated access, even with low-privileged Standard role, can retrieve detailed system version information. This information disclosure could aid in further targeted attacks or reconnaissance but does not directly impact system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a fix is available, restrict authenticated user access to the ugw-deviceinfo method if possible and monitor for unauthorized access.