Cyber Resilience

CVE-2025-6102

HighRCE

Published: 16 June 2025

Published
16 June 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 7.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0162 82.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-6102 is a high-severity Command Injection (CWE-77) vulnerability. Its CVSS base score is 7.4 (High).

Operationally, ranked in the top 17.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

A critical OS command injection vulnerability, tracked as CVE-2025-6102 and assigned CWE-77 and CWE-78, affects an unknown functionality in the file /authentication/logout.php of Wifi-soft UniBox Controller versions up to 20250506. The flaw stems from improper handling of the mac_address argument, which can be manipulated to inject and execute arbitrary operating system commands. The issue received a CVSS 4.0 score of 7.4 and can be triggered remotely without user interaction.

An authenticated remote attacker can exploit the vulnerability by sending a crafted request to the logout endpoint, achieving full command execution on the affected controller. Public proof-of-concept code has been released, enabling potential unauthorized access, data manipulation, or further lateral movement within the network. The vendor was notified prior to disclosure but provided no response or patch.

The EPSS score remains low and unchanged at 0.0162 with no observed rise after publication. Available references consist of a detailed exploit disclosure on GitHub and VulDB entries that document the issue but contain no mitigation guidance or vendor advisory.

EU & UK References

Vulnerability details

A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of the file /authentication/logout.php. The manipulation of the argument mac_address leads to os command injection. The attack can…

more

be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References