What is the CVSS score of CVE-2025-6104?

CVE-2025-6104 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of PHP are affected by CVE-2025-6104?

A critical remote code execution vulnerability affecting Wifi-soft UniBox Controller allows unauthenticated attackers to execute arbitrary operating system commands through a billing module…

How to fix or mitigate CVE-2025-6104?

Within 24 hours: Identify all UniBox Controller instances in production and isolate them from untrusted networks; disable remote access to the /billing/pms_check.php endpoint if operationally feasible. Within 7 days: Implement WAF rules to block requests containing command injection payloads to the ipaddress parameter; conduct network segmentation to restrict access to authorized management networks only. Within 30 days: Contact Wifi-soft vendor for patch availability and timeline; evaluate alternative controllers if vendor remains unresponsive; perform full security audit of affected systems for indicators of compromise.

PHP CVE-2025-6104

EUVD-2025-18360 HIGH

Command Injection (CWE-77)

2025-06-16 cna@vuldb.com

PHP Command Injection

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18360

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

CVE Published

Jun 16, 2025 - 04:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in Wifi-soft UniBox Controller up to 20250506. This affects an unknown part of the file /billing/pms_check.php. The manipulation of the argument ipaddress leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Critical OS command injection vulnerability in Wifi-soft UniBox Controller affecting versions up to 20250506. An authenticated attacker can remotely execute arbitrary operating system commands via the 'ipaddress' parameter in /billing/pms_check.php, achieving complete system compromise. Public exploit code exists, the vendor has not responded to early disclosure, and this vulnerability meets criteria for immediate exploitation in real-world environments.

Technical ContextAI

The vulnerability exists in the billing module of Wifi-soft UniBox Controller, specifically in the pms_check.php file. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection), where user-supplied input from the 'ipaddress' parameter is passed to system-level command execution functions without adequate sanitization or escaping. The UniBox Controller is a network management and billing platform commonly deployed in hotspot and WiFi service environments. The vulnerable endpoint /billing/pms_check.php likely processes payment or connectivity checks and passes network-related parameters (such as IP addresses) to underlying shell commands for network diagnostics or configuration, failing to strip or validate shell metacharacters.