PT-2026-24038 · Ubr · Ubr

Adrien Rey + 1 · CVE-2025-41772 · Published 2026-03-09 · Updated 2026-03-12

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions UBR (affected versions not specified)

Description An unauthenticated remote attacker can obtain valid session tokens. These tokens are exposed in plaintext within the URL parameters of the ''wwwupdate.cgi'' endpoint. The issue involves the exposure of session tokens, potentially allowing unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-598

Related Identifiers

CVE-2025-41772

Affected Products

Ubr

References · 8

• https://osv.dev/vulnerability/CVE-2025-41772 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-41772 · Security Note
• https://mbs-solutions.de/mbs-2025-0001 · Vendor Advisory
• https://t.me/CVEtracker/46874 · Telegram Post
• https://twitter.com/cracbot/status/2032049161068298648 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2030974893873906037 · Twitter Post
• https://twitter.com/CVEarity/status/2031004167616290817 · Twitter Post
• https://twitter.com/CVEnew/status/2031122562898411893 · Twitter Post