What is the CVSS score of CVE-2025-6102?

CVE-2025-6102 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of PHP are affected by CVE-2025-6102?

A critical remote code execution vulnerability exists in Wifi-soft UniBox Controller that allows attackers to execute arbitrary operating system commands through the logout authentication endpoint.

How to fix or mitigate CVE-2025-6102?

Within 24 hours: Identify all UniBox Controller instances in your environment and document their versions; disable remote access to the authentication module if operationally feasible; implement network segmentation to restrict access to /authentication/logout.php to trusted networks only. Within 7 days: Deploy WAF rules to block suspicious mac_address parameter values in requests to /authentication/logout.php; conduct audit logs for signs of exploitation. Within 30 days: Evaluate replacement solutions or request vendor patch status; implement compensating controls for long-term protection until patch availability.

PHP CVE-2025-6102

EUVD-2025-18358 HIGH

Command Injection (CWE-77)

2025-06-16 cna@vuldb.com

PHP Command Injection

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18358

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

CVE Published

Jun 16, 2025 - 03:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of the file /authentication/logout.php. The manipulation of the argument mac_address leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Critical OS command injection vulnerability in Wifi-soft UniBox Controller affecting versions up to 20250506, exploitable through the mac_address parameter in /authentication/logout.php. An authenticated attacker can remotely execute arbitrary OS commands with high impact on confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, and the vendor has not responded to early disclosure attempts, significantly elevating real-world risk.

Technical ContextAI

This vulnerability is rooted in CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection), where unsanitized user input (mac_address parameter) is passed to OS command execution functions without proper escaping or validation. The affected component is the /authentication/logout.php endpoint in Wifi-soft UniBox Controller, a network management appliance. The UniBox Controller is commonly deployed in enterprise WiFi infrastructure management scenarios. The vulnerability likely stems from PHP functions like exec(), system(), passthru(), or shell_exec() receiving unsanitized input from the mac_address GET/POST parameter, allowing an attacker to inject shell metacharacters (pipe, semicolon, backticks, command substitution syntax) to break out of the intended command context and execute arbitrary commands with the privilege level of the web server process (often root or system user in appliance contexts).

RemediationAI

Immediate remediation steps: (1) PATCH: Contact Wifi-soft directly or monitor for security updates; given vendor non-responsiveness, consider product replacement or migration to alternative WiFi management solutions; (2) WORKAROUND: Implement strict network segmentation—restrict access to the UniBox Controller management interface (port for /authentication/logout.php, typically 80/443) to trusted administrative networks only via firewall rules; (3) ACCESS CONTROL: Disable or remove default user accounts; enforce strong authentication policies; implement multi-factor authentication if supported; (4) DETECTION: Monitor for suspicious requests to /authentication/logout.php with unusual mac_address parameter values containing shell metacharacters (;, |, &, `, $(), etc.); (5) ISOLATION: If patch is unavailable, consider taking the affected controller offline and replacing with a patched or alternative solution; (6) AUDIT: Review logs for exploitation attempts; assess if unauthorized command execution has occurred. No vendor patch availability confirmed as of CVE disclosure date.