CVE-2026-35082: Local file inclusion vulnerability and deletion in ugw-logread method

Synopsis

A local file inclusion and deletion vulnerability affects the ugw-logread method across multiple MBS device firmware variants. A remote attacker with low-privilege user credentials can send crafted input to the ugw-logread method over the network, bypassing path or input validation, to access or delete arbitrary files on the device. Successful exploitation gives the attacker full read access to sensitive local files, the ability to tamper with or delete persisted data, and can disrupt the availability of the affected service. A patched-image rebuild at V6_0_0_7 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ugw-logread service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationRequired

  The attacker must hold at least a low-privilege user account on the device; unauthenticated access is not sufficient to invoke the ugw-logread method.

• Victim interactionNot required

  No action from a legitimate user or administrator is needed to trigger the vulnerability; the attacker sends crafted input directly.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond network access and valid credentials.

Blast Radius

• Reads arbitrary local files on the device, including configuration files, credentials, private keys, or stored log data.
• Deletes arbitrary local files, which can corrupt device configuration or remove audit trails.
• Disrupts availability of the affected service or device by removing files critical to normal operation.
• Combines file read and deletion to extract sensitive data and then cover traces of the intrusion.