MBS Universal BACnet Router UBR Web Interface Unchecked Role Vulnerability in wwwdnload.cgi Endpoint

A vulnerability exists in the MBS Universal BACnet Router UBR web interface, specifically within the wwwdnload.cgi endpoint. This issue allows low-privileged remote attackers to download resources intended for administrators, such as system backups and certificate request files. The vulnerability arises because the endpoint only verifies the existence of a session, without checking the associated user role, enabling unauthorized access to sensitive information.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive information, including web interface password hashes and private keys for HTTPS and BACnet/SC services, which could be used to impersonate the device.

Remediation

Users are advised to update to the latest UBR firmware version 6.0.1.0, which addresses this vulnerability. For more details, please check the release notes on the MBS Solutions website.