CVE-2025-6103

Deeper analysis

A critical OS command injection vulnerability, tracked as CVE-2025-6103 and mapped to CWE-77 and CWE-78, affects the Wifi-soft UniBox Controller through version 20250506. The flaw resides in the /billing/test_accesscodelogin.php file, where unsanitized input to the Password argument allows arbitrary operating-system command execution. The issue carries a CVSS 4.0 score of 7.4 and can be reached over the network without user interaction.

An authenticated remote attacker can supply a crafted Password value to execute commands on the underlying system, resulting in full compromise of confidentiality, integrity, and availability on the controller. Public proof-of-concept code has already been released, enabling straightforward exploitation by anyone with low-privileged network access to the device.

No vendor patch or official mitigation guidance is available; the vendor was notified prior to disclosure but did not respond. The referenced advisories and exploit documentation on Vuldb and GitHub simply record the public release of the attack details without providing work-arounds or configuration changes.

EPSS remains flat at 0.02 with no material rise since publication, indicating limited observed exploitation interest to date despite the availability of working exploit code.