CVE-2026-35076

Arbitrary file delete vulnerability in method bac-scanresult

Published Jun 3, 2026 CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Description
The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Mbs-solutions
Mbs-solutions double-a Profibus
Mbs-solutions double-a X-link
Mbs-solutions double-x Can
Mbs-solutions double-x Dali
Mbs-solutions double-x Knx
Mbs-solutions double-x Lon
Mbs-solutions double-x M-bus
Mbs-solutions double-x Profinet
Mbs-solutions double-x X-link
Mbs-solutions single-a
Mbs-solutions single-x
Mbs-solutions triple-x Knx\+dali
Mbs-solutions triple-x Knx\+lon
Mbs-solutions triple-x Knx\+m-bus
Mbs-solutions triple-x Profinet\+dali
Mbs-solutions triple-x Profinet\+knx
Mbs-solutions triple-x Profinet\+lon
Mbs-solutions triple-x Profinet\+m-bus
Mbs-solutions universal Gateway Firmware
CPEs cpe:2.3:h:mbs-solutions:double-a_profibus:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:double-a_x-link:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:double-x_can:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:double-x_dali:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:double-x_knx:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:double-x_lon:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:double-x_m-bus:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:double-x_profinet:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:double-x_x-link:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:single-a:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:single-x:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:triple-x_knx\+dali:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:triple-x_knx\+lon:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:triple-x_knx\+m-bus:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:triple-x_profinet\+dali:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:triple-x_profinet\+knx:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:triple-x_profinet\+lon:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:triple-x_profinet\+m-bus:-:*:*:*:*:*:*:*
cpe:2.3:o:mbs-solutions:universal_gateway_firmware:*:*:*:*:*:*:*:*
Vendors & Products Mbs-solutions
Mbs-solutions double-a Profibus
Mbs-solutions double-a X-link
Mbs-solutions double-x Can
Mbs-solutions double-x Dali
Mbs-solutions double-x Knx
Mbs-solutions double-x Lon
Mbs-solutions double-x M-bus
Mbs-solutions double-x Profinet
Mbs-solutions double-x X-link
Mbs-solutions single-a
Mbs-solutions single-x
Mbs-solutions triple-x Knx\+dali
Mbs-solutions triple-x Knx\+lon
Mbs-solutions triple-x Knx\+m-bus
Mbs-solutions triple-x Profinet\+dali
Mbs-solutions triple-x Profinet\+knx
Mbs-solutions triple-x Profinet\+lon
Mbs-solutions triple-x Profinet\+m-bus
Mbs-solutions universal Gateway Firmware
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
Title Arbitrary file delete vulnerability in method bac-scanresult
First Time appeared Mbs
Mbs double A Profibus Firmware
Mbs double A X Link Firmware
Mbs double X Can Firmware
Mbs double X Dali Firmware
Mbs double X Knx Firmware
Mbs double X Lon Firmware
Mbs double X M Bus Firmware
Mbs double X Profinet Firmware
Mbs double X X Link Firmware
Mbs single A Firmware
Mbs single X Firmware
Mbs triple X Knx Dali Firmware
Mbs triple X Knx Lon Firmware
Mbs triple X Knx M Bus Firmware
Mbs triple X Profinet Dali Firmware
Mbs triple X Profinet Knx Firmware
Mbs triple X Profinet Lon Firmware
Mbs triple X Profinet M Bus Firmware
Weaknesses CWE-73
CPEs cpe:2.3:o:mbs:double_a_profibus_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:double_a_x_link_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:double_x_can_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:double_x_dali_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:double_x_knx_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:double_x_lon_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:double_x_m_bus_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:double_x_profinet_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:double_x_x_link_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:single_a_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:single_x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:triple_x_knx_dali_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:triple_x_knx_lon_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:triple_x_knx_m_bus_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:triple_x_profinet_dali_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:triple_x_profinet_knx_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:triple_x_profinet_lon_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:mbs:triple_x_profinet_m_bus_firmware:*:*:*:*:*:*:*:*
Vendors & Products Mbs
Mbs double A Profibus Firmware
Mbs double A X Link Firmware
Mbs double X Can Firmware
Mbs double X Dali Firmware
Mbs double X Knx Firmware
Mbs double X Lon Firmware
Mbs double X M Bus Firmware
Mbs double X Profinet Firmware
Mbs double X X Link Firmware
Mbs single A Firmware
Mbs single X Firmware
Mbs triple X Knx Dali Firmware
Mbs triple X Knx Lon Firmware
Mbs triple X Knx M Bus Firmware
Mbs triple X Profinet Dali Firmware
Mbs triple X Profinet Knx Firmware
Mbs triple X Profinet Lon Firmware
Mbs triple X Profinet M Bus Firmware
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}

cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
CERTVDE
Published
Updated
Jul 3, 2026, 8:50 AM
Reserved
Apr 1, 2026, 8:28 AM
Status
Analyzed
Published
Jun 3, 2026, 1:16 PM
Modified
Jul 22, 2026, 7:10 PM