CVE-2026-35084: Stack Buffer Overflow in MBS Solutions DALI-DevConfig – Root Privilege Escalation

Technical summary

CVE-2026-35084 is a stack-based buffer overflow (CWE-121) in the dali-devconfig configuration handler within MBS Solutions' multi-protocol gateway and conversion appliances. The vulnerability requires only low-privilege user authentication to trigger, meaning an attacker with basic network credentials—such as a default or shared service account—can craft an oversized input that corrupts the stack and enables arbitrary code execution as the root user. The attack does not require user interaction and can be executed over the network with minimal complexity, as reflected in the CVSS v3.1 score of 8.8 (HIGH).

Business impact

Compromise of these gateway devices could allow an attacker to intercept, modify, or block communications across critical industrial control, HVAC, lighting, and building management networks. In industrial settings, this could lead to production downtime or safety incidents. In commercial buildings, attackers could manipulate DALI lighting control, PROFINET sensor networks, KNX automation, or M-Bus utility metering. The wide product portfolio affected means organizations using MBS Solutions appliances across multiple protocol domains face a unified risk vector.

Affected systems

The vulnerability impacts 19 distinct MBS Solutions product variants, spanning single and multi-protocol gateways. Affected devices include those handling DALI, PROFINET, KNX, M-Bus, LON, CAN, Profibus, and X-Link protocols, as well as the Universal Gateway Firmware. Any organization running these appliances in production should treat this as a widespread exposure requiring immediate inventory verification and patching.

Exploitability

Exploitation is straightforward: an attacker who has obtained or bypassed authentication (through credential compromise, social engineering, or weak default credentials) can send a malformed configuration command to trigger the buffer overflow. The attack requires no special timing or race conditions, no user interaction on the target device, and functions across standard network protocols. The only friction is the requirement for authenticated access, which is minimal in many operational environments where service accounts are shared or poorly rotated.

Remediation

MBS Solutions has released or will release security patches addressing this stack overflow. Organizations must verify patch availability from the vendor's security advisory, test patches in non-production environments given the critical nature of these gateway devices, and coordinate staged deployment to avoid service disruption. Concurrent mitigation should include restricting network access to these devices via firewall rules and reviewing authentication logs for suspicious activity.

Patch guidance

Contact MBS Solutions directly or consult their official security advisory to obtain patched firmware versions for each affected product line. Given the diversity of protocol variants and use cases, patch compatibility and rollback procedures should be validated in a lab environment before production deployment. Prioritize devices that handle business-critical or safety-relevant protocols (PROFINET, KNX) and those exposed to untrusted networks. Document the firmware version before and after patching to enable rollback if required.

Detection guidance

Monitor network traffic to these devices for unusual authentication patterns, especially repeated failed logins or authentication from unexpected source IPs. Review device logs for configuration commands with abnormally large payloads or malformed dali-devconfig requests. Implement network-based anomaly detection to flag sudden changes in device behavior post-compromise, such as new outbound connections or altered protocol behavior. Capture and analyze core dumps if the device crashes unexpectedly, as this may indicate exploitation attempts.

Why prioritize this

This vulnerability combines high severity (CVSS 8.8), low attack complexity, and widespread product impact. While the CVSS does require authenticated access, many operational environments have weak access controls on these gateway appliances. The scope of the product family means a single patch cycle could reduce risk across multiple protocol domains simultaneously. Rapid patching significantly reduces the window of exposure before threat actors gain full system access on critical infrastructure appliances.

Risk score, explained

The CVSS v3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact from root code execution, combined with network accessibility and low attack complexity. The score is appropriately high because compromise of these gateway appliances directly threatens both the confidentiality and integrity of industrial and building automation networks. The presence of authentication requirement prevents a perfect 9.8, but does not substantially reduce operational risk in environments where credentials are weak or shared.

Frequently asked questions