CVE-2025-6104 in UniBox Controller
Summary
by MITRE • 06/16/2025
A vulnerability, which was classified as critical, was found in Wifi-soft UniBox Controller up to 20250506. This affects an unknown part of the file /billing/pms_check.php. The manipulation of the argument ipaddress leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/16/2025
The vulnerability identified as CVE-2025-6104 represents a critical os command injection flaw within the Wifi-soft UniBox Controller software version 20250506 and earlier. This security weakness resides in the /billing/pms_check.php file, which processes incoming network requests and handles ipaddress parameters. The flaw allows attackers to inject malicious operating system commands through the ipaddress argument, potentially enabling full system compromise. The vulnerability's classification as critical stems from its remote exploitability and the potential for arbitrary command execution on the affected device. The attack vector requires no authentication and can be initiated from external networks, making it particularly dangerous for networked environments where such controllers are deployed. Security researchers have confirmed that a public exploit exists for this vulnerability, increasing the risk of widespread exploitation across affected installations.
The technical implementation of this command injection vulnerability follows established patterns where user-controllable input is directly incorporated into system commands without proper sanitization or validation. When the ipaddress parameter is processed by the pms_check.php script, it likely constructs shell commands using string concatenation or similar techniques that do not properly escape or filter special characters. This allows attackers to append malicious commands that get executed with the privileges of the web application process, typically running with elevated permissions on the target system. The vulnerability aligns with CWE-77 and CWE-88 categories, which specifically address command injection flaws where attacker-supplied data is interpreted as commands by the operating system. This flaw also maps to ATT&CK technique T1059.001, which covers command and scripting interpreter, specifically shell scripting, as attackers can leverage this vulnerability to execute arbitrary commands on the compromised system.
The operational impact of CVE-2025-6104 extends beyond simple remote code execution, as it can enable attackers to gain complete control over affected UniBox controllers and potentially use them as launching points for further attacks within networked environments. Compromised controllers could be used to intercept network traffic, redirect connections, or serve as pivot points for lateral movement throughout the network infrastructure. The vulnerability's remote exploitability means that attackers can target these devices from anywhere on the internet without requiring physical access or network credentials. Organizations using Wifi-soft UniBox controllers in critical infrastructure, network monitoring, or billing systems face significant risk of service disruption, data breaches, or unauthorized access to sensitive network resources. The lack of vendor response to early disclosure attempts compounds the risk, as organizations cannot rely on official patches or updates to address the vulnerability.
Organizations should immediately implement network segmentation to isolate affected UniBox controllers from critical network segments and consider blocking access to the specific endpoint /billing/pms_check.php. Network monitoring should be enhanced to detect suspicious command execution patterns and unusual network traffic originating from affected devices. The most effective immediate mitigation involves applying the vendor's patch or update as soon as it becomes available, though given the vendor's lack of response, organizations may need to implement temporary workarounds such as disabling the affected functionality or implementing web application firewalls to filter malicious requests. Additionally, organizations should conduct comprehensive vulnerability assessments to identify all instances of the affected software across their infrastructure and establish monitoring procedures to detect potential exploitation attempts. The vulnerability highlights the importance of maintaining up-to-date security patches and having robust incident response procedures in place for dealing with critical vulnerabilities that lack vendor cooperation.