The ugw-restore method processes user-controlled input without sufficient validation, enabling an attacker with some user privileges to specify arbitrary file paths and cause those files to be deleted. This results in integrity loss and may disrupt system operation. The weakness is a file path traversal vulnerability identified as CWE-73.

MBS firmware products including Double-A Profibus, Double-A x-link, Double-X CAN, Double-X DALI, Double-X KNX, Double-X LON, Double-X M-Bus, Double-X PROFINET, Double-X x-link, Single-A, Single-X, Triple-X KNX+DALI, Triple-X KNX+LON, Triple-X KNX+M-Bus, Triple-X PROFINET+DALI, Triple-X PROFINET+KNX, Triple-X PROFINET+LON, and Triple-X PROFINET+M-Bus. The advisory applies to all firmware versions as no specific version constraints were listed.

The CVSS score of 7.2 indicates a high severity. The EPSS score is not available, so the likelihood of exploitation is unclear, but the lack of KEV listing suggests no widespread exploitation yet. The likely attack vector is remote, requiring an attacker to possess user-level access or to trick a legitimate user into triggering ugw-restore. If exploited, the attacker can delete any file that the firmware process can access, potentially leading to denial of service or loss of critical configuration.