Vulnerability Description
An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mbs-Solutions | Universal Gateway Firmware | < 6_00_07 |
| Mbs-Solutions | Double-A Profibus | - |
| Mbs-Solutions | Double-A X-Link | - |
| Mbs-Solutions | Double-X Can | - |
| Mbs-Solutions | Double-X Dali | - |
| Mbs-Solutions | Double-X Knx | - |
| Mbs-Solutions | Double-X Lon | - |
| Mbs-Solutions | Double-X M-Bus | - |
| Mbs-Solutions | Double-X Profinet | - |
| Mbs-Solutions | Double-X X-Link | - |
| Mbs-Solutions | Single-A | - |
| Mbs-Solutions | Single-X | - |
| Mbs-Solutions | Triple-X Knx\+Dali | - |
| Mbs-Solutions | Triple-X Knx\+Lon | - |
| Mbs-Solutions | Triple-X Knx\+M-Bus | - |
| Mbs-Solutions | Triple-X Profinet\+Dali | - |
| Mbs-Solutions | Triple-X Profinet\+Knx | - |
| Mbs-Solutions | Triple-X Profinet\+Lon | - |
| Mbs-Solutions | Triple-X Profinet\+M-Bus | - |
Related Weaknesses (CWE)
References
- https://www.certvde.com/en/advisories/VDE-2026-039/Vendor Advisory
FAQ
What is CVE-2026-35075?
CVE-2026-35075 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
How severe is CVE-2026-35075?
CVE-2026-35075 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-35075?
Check the references section above for vendor advisories and patch information. Affected products include: Mbs-Solutions Universal Gateway Firmware, Mbs-Solutions Double-A Profibus, Mbs-Solutions Double-A X-Link, Mbs-Solutions Double-X Can, Mbs-Solutions Double-X Dali.