Loading
Generated remediation guidance and an executive summary. No account required.
A low-privileged remote attacker can exploit the ubr-logread method in wwwubr.cgi to read arbitrary files on the system. The endpoint accepts a parameter specifying the log file to open (e.g., /tmp/weblog{some_number}), but this parameter is not properly validated, allowing an attacker to modify it to reference any file and retrieve its contents.
Use CWE-22, Mbs-Solutions vendor hub and Universal Bacnet Router Firmware product page to widen CVE-2025-41755 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2025-41765, CVE-2025-41764 and CVE-2025-41766 for nearby disclosures in the same product family.