Arbitrary Process Termination in the ugw-logstop Method
CVE:
CVE-2026-35081
Product: MBS / UGW Universal Gateway (A-Series, X-Series)
Severity: High 8.1
Published: 03.06.2026
Advisory:
Read the advisory
The ugw-logstop method of the MBS UGW web GUI (firmware before V6_00_07) validates user-supplied input insufficiently (CWE-20). A remote attacker with user privileges can terminate arbitrary processes on the device.