Cyber Posture

CVE-2025-41772

High

Published: 09 March 2026

Published
09 March 2026
Modified
11 March 2026
KEV Added
—
Patch
—
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0005 17.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-41772 is a high-severity Use of GET Request Method With Sensitive Query Strings (CWE-598) vulnerability in Mbs-Solutions Universal Bacnet Router Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-9 Transmission Confidentiality
addresses: CWE-598

Protects sensitive data placed in query strings from interception in transit when confidentiality controls like HTTPS are enforced.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Why these techniques?

Vulnerability in public-facing wwwupdate.cgi endpoint exposes session tokens in plaintext URLs (CWE-598), directly enabling remote exploitation of the web app (T1190) and access to unsecured credentials/tokens (T1552) for session hijacking.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR.

Deeper analysisAI

CVE-2025-41772 affects the UBR software, specifically the wwwupdate.cgi endpoint, where valid session tokens are exposed in plaintext within URL parameters. This vulnerability, published on 2026-03-09, stems from CWE-598 (use of GET request method with sensitive query strings) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with low attack complexity and no privileges required.

An unauthenticated remote attacker can exploit this vulnerability over the network by accessing or intercepting URLs that include the wwwupdate.cgi endpoint, allowing them to obtain valid session tokens directly from the plaintext parameters.

Mitigation details are available in the advisory published by MBS Solutions at https://www.mbs-solutions.de/mbs-2025-0001.

Details

CWE(s)
CWE-598

Affected Products

mbs-solutions
universal bacnet router firmware
≤ 6.0.1.0

CVEs Like This One

CVE-2025-41764Same product: Mbs-Solutions Ubr-01 Mk Ii
CVE-2025-41766Same product: Mbs-Solutions Ubr-01 Mk Ii
CVE-2025-41765Same product: Mbs-Solutions Ubr-01 Mk Ii
CVE-2025-41767Same product: Mbs-Solutions Ubr-01 Mk Ii
CVE-2025-41758Same product: Mbs-Solutions Ubr-01 Mk Ii
CVE-2025-41757Same product: Mbs-Solutions Ubr-01 Mk Ii
CVE-2025-41756Same product: Mbs-Solutions Ubr-01 Mk Ii
CVE-2025-41761Same product: Mbs-Solutions Ubr-01 Mk Ii
CVE-2026-26721Shared CWE-598
CVE-2026-25118Shared CWE-598

References