CVE-2025-41761 PUBLISHED

Privilege escalation possible

Assigner: CERTVDE
Reserved: 16.04.2025 Published: 09.03.2026 Updated: 09.03.2026

A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system access. This is due to the service account being permitted to execute certain binaries (e.g., tcpdump and ip) with sudo.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8

Product Status

Vendor MBS
Product UBR-01 Mk II
Versions Default: unaffected
  • affected from 0.0.0 to 6.0.1.0 (excl.)
Vendor MBS
Product UBR-02
Versions Default: unaffected
  • affected from 0.0.0 to 6.0.1.0 (excl.)
Vendor MBS
Product UBR-LON
Versions Default: unaffected
  • affected from 0.0.0 to 6.0.1.0 (excl.)

Credits

  • Adrien Rey from Cyber Defense Campus Zurich finder
  • Daniel Hulliger from Armasuisse finder

References

Problem Types

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') CWE