CVE-2026-35085: MBS Solutions Stack Buffer Overflow – Root Code Execution Risk

Technical summary

CVE-2026-35085 is a stack buffer overflow (CWE-121) in the gdv-serverconfig component used across MBS Solutions' industrial gateway and protocol conversion product line. The vulnerability has a CVSS 3.1 score of 8.8 (HIGH), with a network attack vector, low attack complexity, and requirement for low-privilege user credentials. Successful exploitation allows an authenticated remote attacker to overwrite stack memory and achieve unauthenticated code execution with root privileges. The flaw exists in multiple product variants spanning protocols including PROFIBUS, PROFINET, KNX, DALI, M-Bus, LON, CAN, and X-Link.

Business impact

Organizations deploying MBS Solutions gateways for industrial automation, building controls, or protocol translation face direct risk of system compromise and potential loss of operational control. A successful exploit grants complete system access as root, enabling attackers to modify configurations, intercept or manipulate protocol communications, and potentially disrupt connected industrial or building systems. The broad product portfolio affected means many organizations may be exposed without immediate visibility. Remediation requires coordinated patching across multiple device types and firmware versions.

Affected systems

Affected products span MBS Solutions' gateway portfolio: Universal Gateway Firmware, Single-A, Single-X, Double-A PROFIBUS, Double-X variants (CAN, DALI, KNX, LON, M-Bus, PROFINET, X-Link), and Triple-X combinations (PROFINET+DALI, PROFINET+KNX, PROFINET+LON, PROFINET+M-Bus, KNX+DALI, KNX+LON, KNX+M-Bus). Organizations should audit inventory to identify which gateway models and firmware versions are deployed and applicable for patching.

Exploitability

Exploitation requires valid user account credentials on the target network or system, but no user interaction or social engineering is necessary once authenticated. The network attack vector and low attack complexity indicate that remote exploitation is straightforward. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date, though this does not guarantee absence of active exploitation. Organizations should assume adversaries capable of obtaining user credentials—whether through compromise, insider threat, or weak credential hygiene—pose an immediate risk.

Remediation

Verify the availability of patched firmware versions from MBS Solutions for each affected product variant and establish a phased patching strategy. Prioritize systems exposed to untrusted networks or handling sensitive protocol traffic. Apply patches in a controlled manner, accounting for potential service disruption during gateway restarts. Where immediate patching is not feasible, implement compensating controls: restrict network access to gateway management interfaces, limit user account privileges, and monitor for suspicious authentication or network activity targeting the affected components.

Patch guidance

Contact MBS Solutions directly or consult their security advisory to obtain patched firmware versions for your specific gateway models. Verify patch availability for all product variants in use before commencing deployment. Test patches in a non-production environment to confirm compatibility with your protocol configurations and downstream systems. Deploy patches during maintenance windows to minimize operational disruption. Document patching progress and maintain records of which devices and firmware versions have been updated for compliance and audit purposes.

Detection guidance

Monitor authentication logs for successful logins from unexpected sources or at unusual times, particularly for service accounts with higher privileges. Implement network-level detection for unusual outbound connections from gateway devices following authentication events. Review system call logs and process execution traces on affected devices for evidence of unexpected code execution or privilege escalation. Maintain baselines of normal gateway behavior and alert on deviations such as unexpected process spawning, memory corruption indicators, or abnormal stack activity. Consider implementing integrity monitoring on the gdv-serverconfig binary and its supporting libraries to detect tampering or exploitation attempts.

Why prioritize this

The combination of high CVSS score (8.8), network-accessible attack surface, low authentication barrier, and broad product portfolio justify immediate prioritization. The ability to achieve root-level code execution from a user-level account makes this a critical escalation path. The industrial automation and building controls domains served by these gateways mean successful exploitation could disrupt operational technology environments. While not yet in the KEV catalog, the straightforward exploitation requirements and sensitive asset class warrant rapid remediation.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high severity: network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for low-privilege user credentials (PR:L), no user interaction needed (UI:N), and the confidentiality, integrity, and availability impacts (C:H/I:H/A:H) all maximum. The primary limiting factor is the requirement for valid user credentials; however, this constraint is weak in environments with compromised accounts, shared credentials, or insider threats. Organizations should treat this as functionally equivalent to an unauthenticated remote code execution vulnerability when user account hygiene is poor.

Frequently asked questions