CVE-2025-6102: Wifi-soft UniBox Controller RCE Vulnerability

CVE-2025-6102 Overview

CVE-2025-6102 is an operating system (OS) command injection vulnerability in Wifi-soft UniBox Controller versions up to 20250506. The flaw resides in the /authentication/logout.php endpoint, where the mac_address parameter is passed to a shell context without proper sanitization. Authenticated remote attackers can inject arbitrary shell commands that execute in the context of the web application. The vulnerability is tracked under CWE-77: Improper Neutralization of Special Elements used in a Command. Public proof-of-concept (PoC) documentation has been disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact
Remote attackers with low-level privileges can execute arbitrary OS commands on the UniBox Controller, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Wifi-soft UniBox Controller versions up to and including 20250506
The vulnerable component is the /authentication/logout.php script
No vendor-supplied patch is available at the time of disclosure

Discovery Timeline

2025-06-16 - CVE-2025-6102 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6102

Vulnerability Analysis

The vulnerability stems from unsafe handling of the mac_address HTTP parameter in /authentication/logout.php. The script forwards user-controlled input into an OS shell command without validation or escaping. Attackers can append shell metacharacters such as ;, |, &&, or backticks to break out of the intended command context. The result is execution of arbitrary commands with the privileges of the web server process. Because the exploit can be launched remotely over the network and requires only low privileges, the attack surface is large for any UniBox deployment exposed to the internet or untrusted networks. Public PoC documentation describes the request structure and parameter manipulation required for exploitation.

Root Cause

The root cause is missing input neutralization on the mac_address argument before it reaches a shell invocation. The application appears to construct a command line using string concatenation rather than parameterized execution. This mirrors the classic [CWE-77] pattern where attacker-supplied data and command syntax share the same channel. Standard MAC address format validation, such as a regular expression matching ^([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$, would have blocked the injection.

Attack Vector

The attack is remote and requires the attacker to reach the controller's web interface with valid low-privilege credentials. An attacker submits a crafted HTTP request to /authentication/logout.php with shell metacharacters embedded in the mac_address parameter. The injected payload executes as part of the underlying shell command, returning command output or enabling follow-on actions such as reverse shells, credential theft, or lateral movement. Refer to the GitHub PoC Documentation for the disclosed request structure.

Detection Methods for CVE-2025-6102

Indicators of Compromise

HTTP POST or GET requests to /authentication/logout.php containing shell metacharacters (;, |, &, `, $() in the mac_address parameter
Unexpected child processes (e.g., sh, bash, wget, curl, nc) spawned by the web server user on the UniBox Controller
Outbound network connections from the controller to unknown hosts immediately following requests to the logout endpoint
New or modified files in web-accessible directories that could indicate webshell deployment

Detection Strategies

Inspect web server access logs for mac_address values that do not match a strict MAC address format
Deploy web application firewall (WAF) rules that block shell metacharacters in parameters expected to contain MAC addresses
Correlate HTTP request logs with process execution telemetry to identify command execution chains originating from the web service
Hunt for known PoC payload patterns referenced in the VulDB entry #312571

Monitoring Recommendations

Forward UniBox web and system logs to a centralized logging or SIEM platform for retention and correlation
Alert on any process creation by the web server account that is not on an allowlist for normal operation
Monitor egress traffic from the controller for connections to non-management destinations
Track authentication events to detect compromised low-privilege accounts used to reach the vulnerable endpoint

How to Mitigate CVE-2025-6102

Immediate Actions Required

Restrict access to the UniBox Controller management interface to trusted administrative networks only, using firewall or VPN controls
Disable or block external access to /authentication/logout.php until a vendor fix is available
Rotate all UniBox user credentials and review accounts for unauthorized access
Audit the controller for signs of prior exploitation, including unexpected processes, files, and outbound connections

Patch Information

No vendor patch is currently available. According to the disclosure, the vendor was contacted but did not respond. Monitor the VulDB entry #312571 and Wifi-soft channels for future updates. Until a patch is released, compensating controls are the only mitigation.

Workarounds

Place the UniBox Controller behind a reverse proxy or WAF that strips or rejects shell metacharacters in the mac_address parameter
Apply network segmentation so the controller cannot initiate arbitrary outbound connections to the internet
Enforce strong authentication and remove unused low-privilege accounts that could be abused to reach the vulnerable endpoint
If feasible, deploy host-based controls on the controller to restrict the web server process from spawning shell interpreters

bash

# Example WAF rule pattern (ModSecurity-style) to block injection attempts
SecRule ARGS:mac_address "!@rx ^([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$" \
    "id:1006102,phase:2,deny,status:400,\
    msg:'CVE-2025-6102: Invalid mac_address parameter blocked'"