Impact Analysis

This vulnerability allows an unauthenticated remote attacker to gain full administrative access to affected devices by recovering a hardcoded password.

Such access can lead to complete system compromise, including unauthorized control, data manipulation, disruption of services, and potential further exploitation within the network.

Given the high CVSS score of 9.8, the impact is severe and poses a significant security risk.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-35075 is a critical security flaw found in MBS Universal Gateways (UGW-A-Series and UGW-X-Series) with firmware versions V6_0_0_5 and earlier.

The vulnerability involves a hardcoded default password embedded in the device firmware. An unauthenticated remote attacker can extract this password from the firmware image.

By recovering this password, the attacker gains full administrative access to all affected devices, allowing complete control over the system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update the firmware of all affected MBS Universal Gateways (UGW-A-Series and UGW-X-Series) to a version later than V6_0_0_5, where the hardcoded default password issue is resolved.

Additionally, restrict remote access to these devices until the firmware is updated to prevent unauthorized attackers from exploiting the hardcoded password.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated remote attackers to gain full administrative access to affected devices by recovering a hardcoded default password from the firmware. Such unauthorized access can lead to compromise of sensitive data and systems.

Given the severity and ease of exploitation, this vulnerability could result in violations of common security requirements in standards and regulations like GDPR and HIPAA, which mandate protection of personal and sensitive data against unauthorized access.

Organizations using affected devices may face compliance risks if this vulnerability is not mitigated, as it undermines the confidentiality, integrity, and availability controls required by these regulations.

Useful 0 Not Useful 0