CVE-2026-35077
Remote File Deletion in UGW via Insufficient Input Validation
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the ugw-delete-file method, which allows a remote attacker who has user privileges to delete arbitrary local files. The issue arises because the method does not properly validate user-controlled input, enabling the attacker to specify files to delete that they should not have access to.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized deletion of local files by an attacker with user privileges. This can result in loss of important data, disruption of services, and potential system instability depending on which files are deleted.