PT-2025-25513 · Wifi Soft · Wifi-Soft Unibox Controller
H0E4A0R1T_-_-
·
Published
2025-06-16
·
Updated
2025-06-21
·
CVE-2025-6102
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Wifi-soft UniBox Controller versions up to 20250506
Description
A critical vulnerability was found in the Wifi-soft UniBox Controller, affecting an unknown functionality of the file /authentication/logout.php. The manipulation of the
mac address argument leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond.Recommendations
For Wifi-soft UniBox Controller versions up to 20250506, as a temporary workaround, consider disabling the /authentication/logout.php file or restricting access to it until a patch is available. Avoid using the
mac address argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
OS Command Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Wifi-Soft Unibox Controller