MBS Universal Gateways UGW Web GUI Arbitrary File Deletion Vulnerability

A vulnerability in the ugw-delete-file method allows remote attackers with user privileges to delete arbitrary local files. This issue arises from inadequate validation of user-controlled input. The vulnerability affects MBS Universal Gateways in the UGW-A-Series and UGW-X-Series, all versions prior to 6.0.0.7.

Impact

Exploitation of this vulnerability could enable an authenticated attacker to delete arbitrary local files on the affected UGW devices, potentially leading to unauthorized access or disruption of service.

Remediation

Users are advised to update to firmware version 6.0.0.7, available at the MBS Firmware Update page.