Stack buffer overflow in method dali-devconfig
Priority MEDIUM 40CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00456 39th percentileScored 2026-11-07
Fix Fixed Single-A (MBS): V6_00_07Double-A Profibus (MBS): V6_00_07+16 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MBS | Single-A | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Double-A Profibus | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Double-A x-link | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Single-X | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Double-X CAN | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Double-X DALI | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Double-X KNX | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Double-X LON | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Double-X M-Bus | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Double-X PROFINET | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Double-X x-link | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Triple-X KNX+DALI | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Triple-X KNX+LON | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Triple-X KNX+M-Bus | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Triple-X PROFINET+DALI | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Triple-X PROFINET+KNX | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Triple-X PROFINET+LON | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
| MBS | Triple-X PROFINET+M-Bus | V1_00_00 to before V6_00_07 | V6_00_07 | Patch available | CNA |
- Single-A VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Double-A Profibus VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Double-A x-link VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Single-X VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Double-X CAN VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Double-X DALI VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Double-X KNX VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Double-X LON VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Double-X M-Bus VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Double-X PROFINET VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Double-X x-link VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Triple-X KNX+DALI VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Triple-X KNX+LON VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Triple-X KNX+M-Bus VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Triple-X PROFINET+DALI VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Triple-X PROFINET+KNX VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Triple-X PROFINET+LON VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
- Triple-X PROFINET+M-Bus VendorMBS Affected V1_00_00 to before V6_00_07 Fixed in V6_00_07 Patch available CNA
CPE configurations NVD · 19
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mbs-solutions:universal_gateway_firmware:*:*:*:*:*:*:*:* | before 6_00_07 | Vulnerable | MBS |
| cpe:2.3:h:mbs-solutions:double-a_profibus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:double-a_x-link:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:double-x_can:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:double-x_dali:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:double-x_knx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:double-x_lon:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:double-x_m-bus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:double-x_profinet:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:double-x_x-link:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
- cpe:2.3:o:mbs-solutions:universal_gateway_firmware:*:*:*:*:*:*:*:* Versions before 6_00_07 Vulnerable ·MBS
- cpe:2.3:h:mbs-solutions:double-a_profibus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:double-a_x-link:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:double-x_can:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:double-x_dali:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:double-x_knx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:double-x_lon:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:double-x_m-bus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:double-x_profinet:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:double-x_x-link:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
Show 9 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:mbs-solutions:single-a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:single-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:triple-x_knx\+dali:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:triple-x_knx\+lon:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:triple-x_knx\+m-bus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:triple-x_profinet\+dali:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:triple-x_profinet\+knx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:triple-x_profinet\+lon:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
| cpe:2.3:h:mbs-solutions:triple-x_profinet\+m-bus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MBS |
- cpe:2.3:h:mbs-solutions:single-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:single-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:triple-x_knx\+dali:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:triple-x_knx\+lon:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:triple-x_knx\+m-bus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:triple-x_profinet\+dali:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:triple-x_profinet\+knx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:triple-x_profinet\+lon:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
- cpe:2.3:h:mbs-solutions:triple-x_profinet\+m-bus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MBS
Remediation
- Fix · CNA Single-A (MBS) Fixed in V6_00_07
- Fix · CNA Double-A Profibus (MBS) Fixed in V6_00_07
- Fix · CNA Double-A x-link (MBS) Fixed in V6_00_07
- Fix · CNA Single-X (MBS) Fixed in V6_00_07
- Fix · CNA Double-X CAN (MBS) Fixed in V6_00_07
- Fix · CNA Double-X DALI (MBS) Fixed in V6_00_07
- Fix · CNA Double-X KNX (MBS) Fixed in V6_00_07
- Fix · CNA Double-X LON (MBS) Fixed in V6_00_07
- Fix · CNA Double-X M-Bus (MBS) Fixed in V6_00_07
- Fix · CNA Double-X PROFINET (MBS) Fixed in V6_00_07
- Fix · CNA Double-X x-link (MBS) Fixed in V6_00_07
- Fix · CNA Triple-X KNX+DALI (MBS) Fixed in V6_00_07
- Fix · CNA Triple-X KNX+LON (MBS) Fixed in V6_00_07
- Fix · CNA Triple-X KNX+M-Bus (MBS) Fixed in V6_00_07
- Fix · CNA Triple-X PROFINET+DALI (MBS) Fixed in V6_00_07
- Fix · CNA Triple-X PROFINET+KNX (MBS) Fixed in V6_00_07
- Fix · CNA Triple-X PROFINET+LON (MBS) Fixed in V6_00_07
- Fix · CNA Triple-X PROFINET+M-Bus (MBS) Fixed in V6_00_07
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
MBS Double-A Profibus, Double-A x-link and 16 more products V6_00_07
11 records Highest priority Priority MEDIUM 5 MEDIUM, 6 LOW
Other records, highest priority first
- TI-2026-27276 Hardcoded default password for service account in MBS Single-APriority MEDIUM 48
- TI-2026-27286 Stack buffer overflow in method gdv-serverconfigPriority MEDIUM 40
- TI-2026-27284 Stack buffer overflow in method bac-deviceobjectPriority MEDIUM 40
Timeline
- 2026-10-02 Threatist record created from CVE-2026-35084
- 2026-10-03 Alias added: GHSA-vg85-v4gp-8v33
References
More MBS Universal Gateway Firmware vulnerabilities
- TI-2026-27276 Hardcoded default password for service account in MBS Single-A CVSS 4.0CRITICAL 9.3
- TI-2026-27286 Stack buffer overflow in method gdv-serverconfig CVSS 4.0HIGH 8.7
- TI-2026-27284 Stack buffer overflow in method bac-deviceobject CVSS 4.0HIGH 8.7
- TI-2026-27283 Local file inclusion vulnerability and deletion in ugw-logread method CVSS 4.0HIGH 8.7
- TI-2026-27280 Arbitrary file delete vulnerability in method ugw-restore CVSS 4.0HIGH 7.2
- TI-2026-27282 Arbitrary process termination vulnerability in method ugw-logstop CVSS 4.0HIGH 7.2
Sources
- CVE-2026-35084 · CVE Program
- CVE-2026-35084 · NVD
- FIRST EPSS
- GHSA-vg85-v4gp-8v33 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences