CVE-2025-41764 Unchecked role in wwwupdate.cgi

What is CVE-2025-41764?

CVE-2025-41764 is a critical missing authorization vulnerability in MBS UBR-01 Mk II, published on 9 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arbitrary updates.

Weakness: CWE-862

Which versions are affected by CVE-2025-41764?

It affects 1 product.

Products include Mbs-Solutions Universal Bacnet Router Firmware.

How do I fix CVE-2025-41764?

No fix has been published for CVE-2025-41764 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-41764 being exploited?

There is no known exploitation of CVE-2025-41764 in the wild and no public exploit code.

Other vulnerabilities in MBS UBR-01 Mk II

• CVE-2025-41765 Unchecked role in wwwupload.cgi Critical 9.1
• CVE-2025-41757 Arbitrary Write with ubr-restore High 8.8
• CVE-2025-41758 Arbitrary Write with wwwupload.cgi High 8.8
• CVE-2025-41766 Stack buffer overflow on parsing web request High 8.8
• CVE-2025-41756 Arbitrary Write with ubr-editfile High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-53mr-9hq5-ccmj.