Mbs-solutions Vulnerabilities

An attacker can exploit a flaw in the universal BACnet router firmware to upload and apply any type of data, such as malicious files or sensitive configuration settings, without proper authorization. This can happen remotely through a specific web endpoint, meaning the attacker doesn’t need physical access to the device.

An attacker can remotely upload and install malicious updates on the universal BACnet router firmware because the system does not properly check if they are authorized to do so. This means that anyone with access to the specific update endpoint can take control of the device without needing any special permissions.