CVE-2025-6104: Wifi-soft UniBox Controller RCE Vulnerability

CVE-2025-6104 Overview

CVE-2025-6104 is an operating system command injection vulnerability affecting Wifi-soft UniBox Controller versions up to 20250506. The flaw resides in the /billing/pms_check.php endpoint, where the ipaddress parameter is passed to system commands without proper sanitization. Authenticated attackers can manipulate this parameter to execute arbitrary operating system commands on the underlying host remotely.

The vulnerability is classified under [CWE-77] Improper Neutralization of Special Elements used in a Command. Public exploit details have been disclosed, and the vendor did not respond to early disclosure attempts.

Critical Impact
Remote attackers with low privileges can execute arbitrary OS commands on the UniBox Controller, leading to full compromise of confidentiality, integrity, and availability of the affected system.

Affected Products

Wifi-soft UniBox Controller versions up to and including 20250506
The /billing/pms_check.php component
No vendor patch is currently available

Discovery Timeline

2025-06-16 - CVE-2025-6104 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-6104

Vulnerability Analysis

The vulnerability exists in the billing module of the Wifi-soft UniBox Controller, specifically in the pms_check.php script. This endpoint accepts an ipaddress parameter that is incorporated into a system-level command without adequate input filtering or escaping. An attacker can append shell metacharacters such as ;, |, or backticks to inject additional commands that execute in the context of the web server process.

Because the attack vector is network-based and requires only low privileges, exploitation can be performed remotely once an attacker obtains valid authentication on the controller. The exploit has been disclosed publicly, increasing the likelihood of opportunistic attacks against exposed instances. EPSS data indicates this CVE sits in the upper percentile of likely-to-be-exploited vulnerabilities.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The ipaddress parameter is concatenated into a shell command, likely intended to invoke a network utility such as ping or a property-management-system check, without being validated against an IP address format or sanitized of shell metacharacters.

Attack Vector

An attacker sends a crafted HTTP request to /billing/pms_check.php with a malicious ipaddress value. By embedding shell separators followed by arbitrary commands, the attacker pivots from a benign network check into command execution. The injected commands run with the privileges of the web application user, enabling reconnaissance, lateral movement, credential theft, or persistence on the appliance.

Further exploitation details are available in the public command injection write-up on GitHub and the VulDB entry #312573.

Detection Methods for CVE-2025-6104

Indicators of Compromise

HTTP requests to /billing/pms_check.php containing shell metacharacters such as ;, |, &, $(), or backticks in the ipaddress parameter
Unexpected child processes spawned by the web server user, particularly shells like /bin/sh or /bin/bash
Outbound network connections from the UniBox Controller to unfamiliar hosts shortly after requests to the billing endpoint
New or modified files in web-accessible directories indicating webshell deployment

Detection Strategies

Inspect web server access logs for requests to pms_check.php with non-IP-format ipaddress values
Deploy web application firewall rules that block shell metacharacters in query and POST parameters destined for the billing endpoint
Correlate web request logs with process execution telemetry to identify command injection chains

Monitoring Recommendations

Forward UniBox Controller web and system logs to a centralized SIEM for cross-source correlation
Alert on any process execution lineage that links the web server process to interactive shells or reconnaissance binaries such as whoami, id, uname, wget, or curl
Baseline normal traffic to /billing/ paths and alert on deviations in request structure or parameter content

How to Mitigate CVE-2025-6104

Immediate Actions Required

Restrict network access to the UniBox Controller management interface to trusted administrative networks only
Place the affected endpoint behind a reverse proxy or WAF that filters shell metacharacters from request parameters
Audit account access on the controller and rotate credentials, since the vulnerability requires low-privilege authentication
Monitor for active exploitation using the indicators outlined above

Patch Information

As of the last NVD update, no official patch has been published by Wifi-soft. The vendor did not respond to the original disclosure. Organizations should track the VulDB advisory for any future vendor remediation and apply updates as soon as they are released.

Workarounds

Block external access to /billing/pms_check.php at the network or proxy layer until a patch is available
Enforce strict input validation at an upstream proxy, allowing only valid IPv4 or IPv6 address formats in the ipaddress parameter
Segment the UniBox Controller from sensitive internal systems to limit blast radius if exploitation occurs
Disable the billing module entirely if it is not in active use

bash

# Example reverse proxy rule (nginx) to block metacharacters in ipaddress parameter
location /billing/pms_check.php {
    if ($arg_ipaddress ~* "[;|&`$()<>\\\"']") {
        return 403;
    }
    proxy_pass http://unibox_backend;
}