CVE-2025-41772 HIGH

CVE-2025-41772: wwwupdate.cgi Session token in URL

Vendor Mbs
Product UBR-01 Mk II
Weakness CWE-598
Published March 9, 2026
Last update March 9, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR.

Key dates

02Disclosure timeline

March 9, 2026 CVE published
March 9, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-32021 Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext CVE-2025-52901 File Browser allows sensitive data to be transferred in URL CVE-2025-62317 HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. CVE-2023-6287 Backup password in GET parameter CVE-2025-2356 BlackVue App API deviceDelete get request method with sensitive query strings