CVE-2025-6103: Wifi-soft UniBox Controller RCE Vulnerability

CVE-2025-6103 Overview

CVE-2025-6103 is an operating system command injection vulnerability in Wifi-soft UniBox Controller through build 20250506. The flaw resides in the /billing/test_accesscodelogin.php endpoint, where the Password parameter is passed to a shell context without proper sanitization. A remote authenticated attacker with low privileges can inject arbitrary shell metacharacters and execute commands on the underlying operating system. The exploit details have been publicly disclosed, and the vendor did not respond to coordinated disclosure attempts. The vulnerability is tracked under [CWE-77] (Improper Neutralization of Special Elements used in a Command).

Critical Impact
Remote attackers can execute arbitrary operating system commands on UniBox Controllers, leading to full compromise of the wireless access management appliance.

Affected Products

Wifi-soft UniBox Controller versions up to and including 20250506
The /billing/test_accesscodelogin.php billing component
Deployments exposing the billing interface to untrusted networks

Discovery Timeline

2025-06-16 - CVE-2025-6103 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6103

Vulnerability Analysis

The vulnerability is an OS command injection issue in the billing module of the Wifi-soft UniBox Controller. The PHP script /billing/test_accesscodelogin.php accepts a Password parameter from an HTTP request and incorporates the value into a shell command without neutralizing shell metacharacters. Attackers supply payloads containing characters such as ;, |, &&, or backticks to break out of the intended command argument and append arbitrary commands. Because UniBox controllers commonly run web services with elevated privileges, successful exploitation typically yields high-impact code execution on the appliance.

The Exploit Prediction Scoring System (EPSS) places this issue in the 82nd percentile, indicating elevated probability of exploitation activity compared to the broader CVE population.

Root Cause

The root cause is unsafe use of user-supplied input in a shell invocation. The PHP code likely passes the Password value into a function such as exec(), system(), shell_exec(), or backtick execution, concatenating it directly into a command string. Without input validation, allow-list filtering, or use of safe APIs that separate command from arguments, any shell metacharacter in the request body reaches the operating system shell.

Attack Vector

The attack is performed remotely over the network. An attacker sends a crafted HTTP request to /billing/test_accesscodelogin.php containing a malicious Password value. The injected payload executes in the context of the web server account on the UniBox appliance. Because the billing portal is typically reachable by users of the wireless infrastructure, the exploitation surface is broad in environments where the controller management or captive portal interface is exposed.

No verified proof-of-concept code is published in the enriched dataset; technical write-up details are available in the GitHub Command Injection Report and VulDB #312572.

Detection Methods for CVE-2025-6103

Indicators of Compromise

HTTP POST requests to /billing/test_accesscodelogin.php containing shell metacharacters such as ;, |, &, $(, or backticks in the Password field.
Unexpected child processes spawned by the PHP or web server process on the UniBox appliance, such as sh, bash, wget, curl, nc, or python.
Outbound connections from the controller to unfamiliar IP addresses immediately after billing endpoint requests.
New files written under web-writable directories or modifications to cron entries on the appliance.

Detection Strategies

Inspect web server access logs for requests to test_accesscodelogin.php with abnormal Password parameter content or unusually long values.
Deploy web application firewall signatures that flag command-injection metacharacters in authentication-related form fields.
Correlate HTTP request telemetry with process-execution events on the appliance to identify shell processes spawned from the web tier.

Monitoring Recommendations

Forward UniBox web and system logs to a centralized log platform and alert on anomalies tied to the billing path.
Monitor egress traffic from controller management networks for connections to non-approved destinations.
Establish a baseline of expected child processes for the web server and alert on deviations.

How to Mitigate CVE-2025-6103

Immediate Actions Required

Restrict network access to the UniBox Controller management and billing interfaces using firewall rules, allow-listing only trusted administrative networks.
Disable or remove the /billing/test_accesscodelogin.php script if it is not required in your deployment.
Rotate credentials used to access the billing portal, since low-privileged accounts can trigger the issue.
Audit appliance logs for prior exploitation indicators dating back to when the affected build was deployed.

Patch Information

No vendor patch is available at the time of publication. According to the public disclosure, the vendor was contacted but did not respond. Operators should monitor VulDB #312572 and Wifi-soft communications for updates and apply fixes as soon as they are released.

Workarounds

Place the UniBox Controller behind a reverse proxy or web application firewall that blocks shell metacharacters in form parameters.
Apply network segmentation so that captive portal clients cannot reach administrative billing endpoints.
If feasible, isolate the controller in a dedicated VLAN with strict egress filtering to limit post-exploitation movement.
Replace exposure of the appliance to untrusted networks with VPN-gated access until a vendor fix is provided.

bash

# Example: restrict access to the billing endpoint at the reverse proxy layer
location ~* /billing/test_accesscodelogin\.php$ {
    allow 10.0.0.0/24;   # trusted admin subnet
    deny  all;
    proxy_pass http://unibox-backend;
}