CVE-2026-35078: Arbitrary file delete vulnerability in method ugw-logstop

Synopsis

An arbitrary file deletion vulnerability exists in the ugw-logstop method across multiple MBS gateway device variants. A remote attacker with low-privilege user credentials can reach the affected endpoint over the network and pass unsanitized input to delete arbitrary files on the local filesystem. Successful exploitation disrupts service availability and allows tampering with stored data, including configuration or log files. A patched-image rebuild at V6_0_0_7 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ugw-logstop endpoint over the network; the service must be exposed to the attacker's network segment.

• AuthenticationRequired

  A low-privilege user account is sufficient; no administrative or elevated credentials are needed beyond basic login access.

• Victim interactionNot required

  No action from any other user or victim is required to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, specific memory layout, or other environmental factors need to align.

Blast Radius

• Attacker deletes arbitrary files on the device filesystem, including configuration files, certificates, or runtime state.
• Deletion of critical files crashes or permanently disables the affected gateway service, causing a loss of availability.
• Persistent disruption is possible if system or recovery files are removed, potentially requiring physical intervention to restore the device.
• Data stored locally on the device, such as logs or operational records, can be irreversibly destroyed.