CVE-2025-41761
Published: 09 March 2026
Summary
CVE-2025-41761 is a high-severity Argument Injection (CWE-88) vulnerability in Mbs-Solutions Universal Bacnet Router Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Sudo and Sudo Caching (T1548.003); ranked at the 1.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-41761 is a privilege escalation vulnerability in the UBR service account, published on 2026-03-09. It stems from the service account being permitted to execute certain binaries, such as tcpdump and ip, with sudo privileges. This misconfiguration allows a low-privileged local attacker with access to the account to escalate to full system access. The issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-88 (Improper Neutralization of Argument Delimiters in a Command).
A low-privileged local attacker who obtains access to the UBR service account, such as via SSH, can exploit this vulnerability. By leveraging the sudo permissions on the specified binaries, the attacker achieves privilege escalation, resulting in high-impact compromise of confidentiality, integrity, and availability on the affected system.
Mitigation details are available in the advisory from MBS Solutions at https://www.mbs-solutions.de/mbs-2025-0001.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208368
Vulnerability details
A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system access. This is due to the service account being permitted to execute certain binaries (e.g., tcpdump and ip)…
more
with sudo.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct sudo misconfiguration on binaries (tcpdump/ip) enabling local privilege escalation from service account.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces least privilege by restricting the UBR service account from unnecessary sudo access to binaries like tcpdump and ip, directly preventing privilege escalation.
Requires management of service accounts including periodic review and approval of privilege assignments, mitigating excessive sudo permissions on the UBR account.
Mandates secure configuration settings for system components like the sudoers file to prevent misconfigurations enabling privilege escalation via allowed binaries.