What is the CVSS score of CVE-2025-6103?

CVE-2025-6103 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of PHP are affected by CVE-2025-6103?

A critical remote code execution vulnerability affecting Wifi-soft UniBox Controller allows unauthenticated attackers to execute arbitrary operating system commands through a billing login endpoint.

How to fix or mitigate CVE-2025-6103?

Within 24 hours: Identify all UniBox Controller instances in your environment and isolate affected systems from production networks if versions are 20250506 or earlier. Within 7 days: Implement network access controls to restrict external access to /billing/test_accesscodelogin.php and deploy WAF rules to block malicious password parameter payloads; escalate vendor contact through all available channels. Within 30 days: Evaluate alternative controller solutions; develop migration plan if vendor remains unresponsive; maintain daily vulnerability scanning for exploit attempts.

PHP CVE-2025-6103

EUVD-2025-18357 HIGH

Command Injection (CWE-77)

2025-06-16 cna@vuldb.com

PHP Command Injection

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18357

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

CVE Published

Jun 16, 2025 - 03:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functionality of the file /billing/test_accesscodelogin.php. The manipulation of the argument Password leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A critical OS command injection vulnerability exists in Wifi-soft UniBox Controller versions up to 20250506 within the /billing/test_accesscodelogin.php file's Password parameter, allowing authenticated remote attackers to execute arbitrary system commands with high impact on confidentiality, integrity, and availability. Public exploit code has been disclosed and the vendor has not responded to early disclosure notifications, indicating active exploitation risk and lack of official patches.

Technical ContextAI

The vulnerability is rooted in CWE-77 (Improper Neutralization of Special Elements used in a Command - 'Command Injection'), where user-supplied input from the Password parameter in /billing/test_accesscodelogin.php is passed unsanitized to OS command execution functions. Wifi-soft UniBox Controller is a network management and billing platform that handles authentication and access control. The vulnerability likely stems from PHP code that directly concatenates user input into system calls (exec(), system(), shell_exec(), or passthru()) without proper escaping or parameterized command execution. The affected file's purpose in testing access code logins suggests it may be a debug or administrative interface that inadequately validates cryptographic or authentication parameters before executing backend system commands.

RemediationAI

Immediate actions: (1) Restrict network access to /billing/test_accesscodelogin.php via WAF or firewall rules, blocking external and unnecessary internal access; (2) Implement input validation and output encoding for all Password parameters using allowlist patterns; (3) Replace all OS command execution with parameterized APIs (e.g., proc_open with array arguments in PHP) to prevent injection; (4) Upgrade to a patched version once vendor releases one—monitor Wifi-soft security advisories and GitHub/vulnerability databases for version >20250506; (5) Consider disabling or removing the /billing/test_accesscodelogin.php endpoint if it is debug-only functionality; (6) Implement runtime command execution logging and monitoring to detect exploitation attempts. No official patch or vendor advisory link is available given non-response; third-party security patches or forks may emerge if community response occurs.