CVE-2026-75167: n/a

This vulnerability exists in the ugw-usr-edit method of the /cgi-bin/wwwugw.cgi endpoint in MBS-Solutions X-Serie Gateway firmware version V6_00_05. It allows a remote authenticated user who holds the Standard role, which is considered low-privileged, to change passwords of arbitrary user accounts. This represents a broken access control issue (CWE-284) where authorization checks are insufficient or improperly enforced, enabling privilege escalation through password modification.

An attacker with low-privileged authenticated access can change passwords of other user accounts, potentially leading to unauthorized account takeover and privilege escalation. The vulnerability does not impact confidentiality or availability directly but impacts integrity by allowing unauthorized modification of account credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to trusted users only and monitor for suspicious password changes. Avoid granting unnecessary Standard role access to untrusted users.