MBS UGW Web GUI Arbitrary File Deletion Vulnerability

A vulnerability in the ugw-restoreinfo method allows remote attackers with user privileges to delete arbitrary local files. This issue arises from inadequate validation of user-controlled input. The vulnerability affects MBS Universal Gateways (UGW-A-Series and UGW-X-Series) running firmware versions prior to V6_0_0_7.

Impact

Exploitation of this vulnerability could enable an authenticated attacker to delete arbitrary local files on the affected UGW devices.

Remediation

Users are advised to update to firmware version V6_0_0_7, available at the MBS Firmware Update page.