CVE-2026-35080
Remote File Deletion in UGW via ugw-restoreinfo Method
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mbs | universal_gateway | to 6.0.0.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the ugw-restoreinfo method, which allows a remote attacker who has user privileges to delete arbitrary local files. The root cause is insufficient validation of user-controlled input, meaning the method does not properly check or restrict the input provided by the user, enabling malicious actions.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized deletion of local files by an attacker with user privileges. This can result in loss of important data, disruption of services, and potential system instability or denial of service.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
This unauthorized deletion of files could lead to data loss or tampering, which may impact the integrity and availability of sensitive information.
Such impacts could potentially affect compliance with standards and regulations like GDPR and HIPAA, which require protection of data integrity and availability.
However, there is no explicit information provided in the available resources about the direct effects of this vulnerability on compliance with these regulations.