CVE-2025-41762 - CVE House

Status published Medium CVE-2025-41762

Secret leak with wwwdnload.cgi

6.2 CVSS

Vulnerability Description

An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to sensitive data, including password hashes and certificates.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-41762

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Adrien Rey from Cyber Defense Campus Zurich
Daniel Hulliger from Armasuisse

References

https://www.mbs-solutions.de/mbs-2025-0001

More from MBS

View All →

CVE-2025-41772

wwwupdate.cgi Session token in URL

High 7.5

CVE-2025-41767

Signature bypass on update upload

High 7.2

CVE-2025-41766

Stack buffer overflow on parsing web request

High 8.8

CVE-2025-41765

Unchecked role in wwwupload.cgi

Critical 9.1

CVE-2025-41764

Unchecked role in wwwupdate.cgi

Critical 9.1

Affected Vendor

MBS

View all reports →

Affected Software

UBR-01 Mk II, UBR-02, UBR-LON

Vulnerable Versions:

0.0.0

Timeline

Official Publish: March 9th, 2026

Last Modified: March 9th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-328

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.