MBS Universal Gateway Stack-Based Buffer Overflow Vulnerability Allowing Root Code Execution

A stack-based buffer overflow vulnerability has been identified in the MBS Universal Gateway (UGW) web GUI, specifically in the UGW-A-Series and UGW-X-Series models, all running MBS Firmware prior to V6_0_0_7. This vulnerability allows remote attackers with user privileges to execute arbitrary code with root privileges, potentially leading to a full system compromise. The issue arises from several CGI methods that lack proper input validation and bounds checking, enabling authorized attackers to exploit the buffer overflow.

Impact

Exploitation of this vulnerability allows authenticated attackers to perform stack-based buffer overflows, executing arbitrary code with root privileges and potentially compromising the entire system.

Remediation

Users are advised to update to MBS Firmware version V6_0_0_7, available at the MBS Firmware Update page.