CVE-2026-75165: n/a

This vulnerability exists in the /cgi-bin/wwwugw.cgi component of MBS-Solutions X-Serie Gateway firmware version V6_00_05. A remote attacker authenticated with a low-privileged Standard role can invoke hidden network diagnostic functions such as ugw-ping and ugw-traceroute. These functions are not exposed in the web interface but can be accessed directly, allowing the attacker to gather sensitive network information. The CVSS v3.1 score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

An attacker with low-privileged authenticated access can obtain sensitive network diagnostic information that is normally hidden. This could aid in further reconnaissance or targeted attacks. There is no indication of integrity or availability impact. The confidentiality impact is rated high due to exposure of sensitive information.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected web interface to trusted users only and monitor for unauthorized use of hidden diagnostic functions.