The MBS UGW Universal Gateway firmware before V6_00_07 ships with a hard-coded default password for a service account (CWE-1393). An unauthenticated remote attacker can recover this password from a firmware image and thereby gain full access to all affected devices.