Arbitrary Read with ubr-editfile

An attacker with basic network access can read any file on the system by using a hidden, undocumented feature in the web server. This is dangerous because sensitive files like passwords or configuration data could be exposed.

The ubr-editfile method in wwwubr.cgi lacks proper access controls and input validation, allowing unauthenticated or low-privileged remote attackers to perform arbitrary file reads. The vulnerability stems from an undocumented API endpoint that was not properly secured or removed from the codebase.