CVE-2025-41761
📋 TL;DR
A local privilege escalation vulnerability allows low-privileged attackers with access to the UBR service account to gain full system control. This occurs because the service account can execute privileged binaries like tcpdump and ip via sudo. Systems using UBR service accounts with sudo permissions for these binaries are affected.
💻 Affected Systems
- UBR service
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root access, allowing complete control over the system, data theft, persistence, and lateral movement.
Likely Case
Privilege escalation to root by local attackers who have already gained UBR service account access, leading to system manipulation and data access.
If Mitigated
Limited impact if sudo permissions are properly restricted and service account access is controlled.
🎯 Exploit Status
Exploitation requires initial access to UBR service account, then simple sudo command execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.mbs-solutions.de/mbs-2025-0001
Restart Required: No
Instructions:
1. Check vendor advisory for patches. 2. Apply security updates if available. 3. Review sudo permissions for UBR service account.
🔧 Temporary Workarounds
Restrict sudo permissions
linuxRemove or restrict sudo permissions for the UBR service account to prevent privilege escalation.
sudo visudo
# Remove or modify lines granting UBR service account sudo access to tcpdump, ip, etc.
Implement least privilege
linuxEnsure UBR service account only has necessary permissions and cannot execute privileged binaries.
sudo usermod -aG restricted_group ubr_service_account
# Configure appropriate group permissions
🧯 If You Can't Patch
- Remove sudo permissions for UBR service account from /etc/sudoers or /etc/sudoers.d/
- Implement strict access controls and monitoring for UBR service account activities
🔍 How to Verify
Check if Vulnerable:
Check sudo permissions for UBR service account: sudo -l -U ubr_service_accountCheck Version:
Check UBR service version via package manager or vendor documentationVerify Fix Applied:
Verify sudo permissions are removed: sudo -l -U ubr_service_account should show no dangerous privileges📡 Detection & Monitoring
Log Indicators:
- sudo command execution by UBR service account
- unusual privilege escalation attempts
Network Indicators:
- None - local exploitation only
SIEM Query:
source="sudo" AND user="ubr_service_account" AND command IN ("tcpdump", "ip")