CVE-2026-35077: Arbitrary file delete vulnerability in method ugw-delete-file

Synopsis

An arbitrary file deletion vulnerability exists in the ugw-delete-file method across multiple MBS gateway device firmware variants. A remote attacker with standard user-level privileges can send a crafted request over the network to delete any local file on the device, due to missing or insufficient validation of the file path parameter. Successful exploitation enables an attacker to corrupt or destroy configuration and system files, disrupting device operation or rendering the device unresponsive. A patched-image rebuild at V6_0_0_7 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected device's ugw-delete-file endpoint over the network; the service must be exposed to the attacker's network segment.

• AuthenticationRequired

  A low-privilege user account is sufficient; no administrative or elevated credentials are needed to invoke the vulnerable method.

• Victim interactionNot required

  No user interaction is required; the attacker sends requests directly to the endpoint without any victim needing to take action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or environmental dependencies.

Blast Radius

• Deletes arbitrary files from the local filesystem, including device configuration files, certificates, or credentials stored on disk.
• Destroys firmware or runtime state files, leaving the device in a degraded or non-functional state.
• Removes logging or audit trail files, erasing evidence of prior activity on the device.
• Triggers a denial-of-service condition by deleting files critical to device operation, forcing an outage or manual recovery.