EUVD-2025-18360CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
A vulnerability, which was classified as critical, was found in Wifi-soft UniBox Controller up to 20250506. This affects an unknown part of the file /billing/pms_check.php. The manipulation of the argument ipaddress leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Analysis
Critical OS command injection vulnerability in Wifi-soft UniBox Controller affecting versions up to 20250506. An authenticated attacker can remotely execute arbitrary operating system commands via the 'ipaddress' parameter in /billing/pms_check.php, achieving complete system compromise. Public exploit code exists, the vendor has not responded to early disclosure, and this vulnerability meets criteria for immediate exploitation in real-world environments.
Technical Context
The vulnerability exists in the billing module of Wifi-soft UniBox Controller, specifically in the pms_check.php file. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection), where user-supplied input from the 'ipaddress' parameter is passed to system-level command execution functions without adequate sanitization or escaping. The UniBox Controller is a network management and billing platform commonly deployed in hotspot and WiFi service environments. The vulnerable endpoint /billing/pms_check.php likely processes payment or connectivity checks and passes network-related parameters (such as IP addresses) to underlying shell commands for network diagnostics or configuration, failing to strip or validate shell metacharacters.
Affected Products
UniBox Controller (All versions up to and including 20250506)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today