Arbitrary Read with ubr-editfile
CVE:
CVE-2025-41754
Product: Universal BACnet Routers (UBR)
Severity: Medium 6.5
Published: 28.11.2025
Advisory:
Read the advisory
An adversary having user account can read any file on the system. He can then among other things:
- Read /etc/shadow and try to recover the service password to ssh to the machine
- Read the web interface credentials in /ubr/config/user.cfg and try to recover their passwords
- Read the private key of the https server (/ubr/etc/certs/httpd.pem) or the BACnet/SC service(/ubr/etc/certs/1_srvr-pkey.pem).
CWE: CWE-863:Incorrect Authorization