PT-2025-25514 · Wifi Soft · Wifi-Soft Unibox Controller
H0E4A0R1T_-_-
·
Published
2025-06-16
·
Updated
2025-06-21
·
CVE-2025-6103
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Wifi-soft UniBox Controller versions up to 20250506
Description
A critical issue has been found, affecting some unknown functionality of the file /billing/test accesscodelogin.php. The manipulation of the
Password argument leads to os command injection. This issue can be exploited remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted about this disclosure but did not respond.Recommendations
For Wifi-soft UniBox Controller versions up to 20250506, as a temporary workaround, consider restricting access to the /billing/test accesscodelogin.php file and avoid using the
Password argument in this context until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
OS Command Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Wifi-Soft Unibox Controller