CVE-2026-35081: Arbitrary process termination vulnerability in method ugw-logstop

Synopsis

An arbitrary process termination vulnerability exists in the ugw-logstop method across multiple MBS device firmware variants. A remote attacker with low-privilege user credentials can reach this method over the network and supply unsanitized input to kill arbitrary processes on the device. Successful exploitation allows the attacker to disrupt or destroy running services and tamper with the integrity of persisted or in-flight data. A patched-image rebuild at V6_0_0_7 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ugw-logstop method over the network (AV:N); the device must be network-accessible to be targeted.

• AuthenticationRequired

  A low-privilege user account is sufficient; no administrative credentials are needed (PR:L).

• Victim interactionNot required

  No user interaction is needed; the attacker can exploit this entirely without involving any other party (UI:N).

• Attack complexityDetail

  Exploit conditions are reliable and require no special environmental setup or race conditions (AC:L, AT:N).

Blast Radius

• The attacker can terminate arbitrary processes on the device, immediately halting any service or daemon running on the host.
• Killing critical processes corrupts or discards in-flight data and can leave persistent state in an inconsistent or unrecoverable condition (VI:H).
• Service availability is destroyed for any process the attacker targets, including protocol bridges and logging daemons, causing operational outages (VA:H).
• Scope is contained to the affected device itself; no lateral impact to adjacent systems is indicated by the CVSS vector (SC:N, SI:N, SA:N).