Quick Look: CVE-2026-35075 — Hardcoded Default Password in MBS Universal Gateways Exposes Building Automation Networks

Introduction

A single hardcoded password, baked into firmware and shared across 18 building automation gateway models, is all it takes for an unauthenticated remote attacker to gain full control of every affected MBS Universal Gateway on the network. CVE-2026-35075, disclosed on June 3, 2026 with a CVSS v3.x score of 9.8, is the most severe entry in an 11-vulnerability advisory. Together, those vulnerabilities expose the entire MBS UGW product line to remote compromise, privilege escalation to root, arbitrary file access, and service disruption.

MBS GmbH is a German company with more than 30 years of history in industrial and building automation. It specializes in protocol translation gateways that bridge communication between systems using BACnet, KNX, DALI, LON, M-Bus, PROFINET, and Profibus. The company is a partner in the Bosch Rexroth ctrlX AUTOMATION ecosystem, and its Universal Gateways are deployed in building management environments, where they carry traffic between otherwise separate automation protocols. That position means a compromised gateway may give an attacker a pivot point into the wider building automation network that controls HVAC, lighting, energy metering, and access control systems.

Technical Information

Root Cause: Hardcoded Default Password in Firmware

CVE-2026-35075 is classified under CWE-1393 (Use of Default Password), with close relationships to CWE-798 (Use of Hard-coded Credentials) and CWE-259 (Use of Hard-coded Password). The NVD description states explicitly that "an unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices." The word "all" is accurate. The MBS Universal Gateway product line is built on a common software platform, with a central data point manager and software-based protocol processing, so the same hardcoded credential exists in every firmware image across all 18 affected models.

CWE-1393 belongs to several ICS-specific categories, including Category 1364 (ICS Communications: Zone Boundary Failures), Category 1366 (ICS Communications: Frail Security in Protocols), Category 1368 (ICS Dependencies: External Digital Systems), and Category 1376 (ICS Engineering: Security Gaps in Commissioning). Those memberships reflect how entrenched this class of weakness is in OT/ICS security.

CVSS v4.0 Vector Analysis

The CVSS v4.0 vector string is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, which yields a score of 9.3 (CRITICAL). The metrics break down as follows:

Every metric is at its worst-case value, and the vector itself contains no mitigating factors.

Attack Flow

Exploiting CVE-2026-35075 follows a predictable sequence:

1. The attacker obtains a firmware image for any affected MBS UGW device. Firmware images are typically available from vendor download portals or can be captured during update processes.

2. The attacker runs static analysis on the firmware binary to locate and extract the hardcoded default password. As the CWE-1393 documentation notes, "many lists of default passwords and default password scanning tools [are] readily available on the World Wide Web."

3. The attacker uses the extracted credential to authenticate to the UGW web GUI of any deployed device running firmware prior to V6_0_0_7. Because the password is identical across all product instances, a single extraction compromises the entire fleet.

4. Once authenticated with user-level privileges, the attacker can chain the remaining 10 CVEs in advisory VDE-2026-039 for escalation and lateral movement.

The Full Attack Chain: 11 CVEs in VDE-2026-039

CVE-2026-35075 is the only vulnerability in the advisory that requires no authentication. It is the initial access vector, and the remaining vulnerabilities become exploitable after it:

The three stack-based buffer overflows escalate privileges to root, which gives the attacker complete control over the underlying operating system. Add the path traversal for arbitrary file reads and the five file deletion vulnerabilities, and an attacker who starts with CVE-2026-35075 can fully compromise the system: read any file, execute arbitrary code as root, delete critical system files, and terminate running processes.

Affected Systems and Versions

All affected products are MBS Universal Gateways running firmware versions prior to V6_0_0_7. The advisory covers 18 distinct models across two product series:

UGW-A-Series:

• Double-A Profibus
• Double-A x-link
• Single-A

UGW-X-Series (Single Protocol):

• Double-X CAN
• Double-X DALI
• Double-X KNX
• Double-X LON
• Double-X M-Bus
• Double-X PROFINET
• Double-X x-link

UGW-X-Series (Multi Protocol):

• Triple-X KNX+DALI
• Triple-X KNX+LON
• Triple-X KNX+M-Bus
• Triple-X PROFINET+DALI
• Triple-X PROFINET+KNX
• Triple-X PROFINET+LON
• Triple-X PROFINET+M-Bus

These gateways connect devices that use digital communication protocols within building automation, including BACnet, KNX, DALI, LON, M-Bus, PROFINET, and Profibus. Because they share one software platform, the hardcoded password vulnerability is systemic across the entire product line rather than isolated to specific models.

Vendor Security History

This appears to be the first publicly disclosed security advisory against MBS GmbH products through the CERT@VDE coordination process. The vulnerabilities were reported by Adrien Rey from Cyber Defense Campus Zurich and Daniel Hulliger from Armasuisse, the Swiss federal competence center for cybersecurity and defense technology. The involvement of defense-sector researchers suggests that these devices are deployed in environments of national security interest.

CERT@VDE assigned the CVE. It became Germany's first Root CNA (CVE Numbering Authority) on July 25, 2025, which made it the central point of contact in the global CVE program for its industrial automation partners. An industrial-focused CNA handling this disclosure is one more sign that these vulnerabilities matter for OT/ICS.

Eleven CVEs disclosed at once, spanning hardcoded credentials, buffer overflows, path traversal, improper input validation, and external control of file paths, suggest that the UGW web GUI had not previously undergone a rigorous security review. The range of weakness types points to systemic gaps in secure development rather than one isolated coding error.

Mitigation

The primary remediation is to update affected products to firmware version V6_0_0_7, available at en.mbs-solutions.de/firmwareupdate. This update addresses all 11 CVEs in the advisory at once.

For organizations that cannot apply the firmware update right away, the MITRE CWE-1393 documentation prescribes mitigations at four phases, with varying effectiveness:

Practical compensating controls for deployed systems include:

• Isolate MBS UGW devices on dedicated network segments with restricted access. The attack vector is network-based and requires no authentication, so limiting network reachability is the most effective compensating control.
• If the firmware lets administrators change the default password, change it immediately on all deployed devices.
• Monitor the network for authentication attempts that use known default credentials against UGW web GUI interfaces.

Threat Intelligence Context

As of June 3, 2026, there is no evidence of active exploitation of CVE-2026-35075 in the wild, and the CVE does not appear on CISA's Known Exploited Vulnerabilities (KEV) Catalog. However, the CVE was published on the same day as this analysis, and its exploitation status could change rapidly.

Default-password vulnerabilities of this type have a well-documented history of rapid exploitation once the credentials become known. The OT:ICEFALL study (2022) examined products from 10 OT vendors, reported 56 vulnerabilities, and concluded that products were "insecure by design," with multiple OT products found to use default credentials. Forescout's research on building automation system vulnerabilities found that "default passwords, hardcoded credentials, and single factor authentication are still common" in smart building deployments, and that "attackers can find exposed systems through public" search tools and default credential lists.

Several factors raise the risk of near-term exploitation:

• The password can be extracted through static analysis of any firmware binary.
• The attack requires no authentication and is network accessible.
• The product family is used in building automation, where devices are often exposed to the internet for remote management.
• Default-password extraction is trivially automatable with existing scanning tools.
• The companion vulnerabilities provide a complete attack chain from initial access to full root-level control.

No specific threat actor attribution is available at the time of publication.

References

• NVD: CVE-2026-35075
• CERT@VDE Advisory VDE-2026-039: MBS Several Security Vulnerabilities in the UGW Web GUI
• CWE-1393: Use of Default Password
• CWE-798: Use of Hard-coded Credentials
• CWE-259: Use of Hard-coded Password
• CWE-1392: Use of Default Credentials
• CERT@VDE becomes Germany's first Root CNA
• MBS GmbH
• MBS Universal Gateways Overview
• MBS GmbH in ctrlX AUTOMATION Ecosystem
• Forescout: Discovering and Defending Against Vulnerabilities in Building Automation Systems
• Smart Buildings Cybersecurity Risks
• CISA Known Exploited Vulnerabilities Catalog
• CERT@VDE Dashboard