Out-of-bounds write (CWE-787) in the web interface of the MBS Universal BACnet Router firmware before V6.0.1.0. While parsing the "method": "ubr-network" HTTP POST request, the code iterates over the user-controlled routingItems JSON array, builds a short string per element (max 63 bytes), and unconditionally strcats it into a fixed-size 0x8001-byte stack buffer. A sufficiently large array overflows the buffer, overwrites the saved return address, and allows an attacker to hijack execution flow. A low-privileged remote attacker with a valid user or admin session can exploit this to achieve full device compromise.

MBS vendor advisory: MBS-2025-0001.