CVE-2026-35082

Analyzed Analyzed - Analysis Complete

Remote File Access via ugw-logread Method

Publication date: 2026-06-03

Last updated on: 2026-07-03

Assigner: CERT VDE

Description

The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-03

Last Modified

2026-07-03

Generated

2026-07-14

AI Q&A

2026-06-03

EPSS Evaluated

2026-07-12

NVD

CVE-2026-35082

EUVD

EUVD-2026-34078

Affected Vendors & Products

Vendor	Product	Version / Range
mbs-solutions	universal_gateway_firmware	to 6_00_07 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Compliance Impact

The vulnerability allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.

Such unauthorized access to local files could lead to exposure of sensitive or personal data, potentially impacting compliance with data protection regulations like GDPR and HIPAA that require protection of personal and health information.

However, specific impacts on compliance or regulatory requirements are not detailed in the provided information.

Executive Summary

This vulnerability exists in the ugw-logread method, which allows a remote attacker who already has user privileges to access arbitrary local files on the system.

The root cause is insufficient validation of user-supplied input, meaning the method does not properly check or restrict the input provided by the user, enabling unauthorized file access.

Impact Analysis

An attacker exploiting this vulnerability can read arbitrary local files, potentially gaining access to sensitive information stored on the system.

Since the attacker requires only user privileges, this could lead to significant data exposure or leakage, escalating the impact beyond the attacker's initial access level.

Hi! I’m here to help you understand CVE-2026-35082. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70