CVE-2026-35080: Arbitrary file delete vulnerability in method ugw-restoreinfo

Synopsis

An arbitrary file deletion vulnerability affects the ugw-restoreinfo method in multiple MBS device firmware variants (Single-A, Double-A Profibus, Double-A x-link, Single-X, Double-X CAN, Double-X DALI, Double-X KNX, and Double-X LON), all versions prior to V6_0_0_7. A remote attacker with low-privilege user credentials can send crafted input to the ugw-restoreinfo method over the network, bypassing input validation to delete arbitrary files on the local filesystem. Successful exploitation lets an attacker corrupt or destroy critical system files, disrupting service availability, or tamper with configuration and operational data. A patched-image rebuild at V6_0_0_7 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ugw-restoreinfo service over the network (AV:N); the device must be accessible from the attacker's network position.

• AuthenticationRequired

  A low-privilege user account is sufficient to exploit this vulnerability; no administrative or elevated credentials are needed (PR:L).

• Victim interactionNot required

  No victim interaction is required; the attacker sends the malicious request directly without any user action (UI:N).

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or memory-layout dependencies (AC:L).

Blast Radius

• Deletes arbitrary files on the local filesystem of the affected MBS device, including configuration files, operational data, or system binaries.
• Destruction of critical system files can crash or render the affected device permanently inoperable until it is re-imaged or restored (VA:H).
• Deletion of configuration or firmware components corrupts the integrity of the device's operational state, enabling persistent disruption of connected industrial or building-automation processes (VI:H).
• No confidentiality impact is indicated; the exploit does not expose stored data to the attacker (VC:N).