CVE-2025-6102
Published: 16 June 2025
Summary
CVE-2025-6102 is a high-severity Command Injection (CWE-77) vulnerability. Its CVSS base score is 7.4 (High).
Operationally, ranked in the top 17.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A critical OS command injection vulnerability, tracked as CVE-2025-6102 and assigned CWE-77 and CWE-78, affects an unknown functionality in the file /authentication/logout.php of Wifi-soft UniBox Controller versions up to 20250506. The flaw stems from improper handling of the mac_address argument, which can be manipulated to inject and execute arbitrary operating system commands. The issue received a CVSS 4.0 score of 7.4 and can be triggered remotely without user interaction.
An authenticated remote attacker can exploit the vulnerability by sending a crafted request to the logout endpoint, achieving full command execution on the affected controller. Public proof-of-concept code has been released, enabling potential unauthorized access, data manipulation, or further lateral movement within the network. The vendor was notified prior to disclosure but provided no response or patch.
The EPSS score remains low and unchanged at 0.0162 with no observed rise after publication. Available references consist of a detailed exploit disclosure on GitHub and VulDB entries that document the issue but contain no mitigation guidance or vendor advisory.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-18358
Vulnerability details
A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of the file /authentication/logout.php. The manipulation of the argument mac_address leads to os command injection. The attack can…
more
be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.