EUVD-2025-18357
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functionality of the file /billing/test_accesscodelogin.php. The manipulation of the argument Password leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Analysis
A critical OS command injection vulnerability exists in Wifi-soft UniBox Controller versions up to 20250506 within the /billing/test_accesscodelogin.php file's Password parameter, allowing authenticated remote attackers to execute arbitrary system commands with high impact on confidentiality, integrity, and availability. Public exploit code has been disclosed and the vendor has not responded to early disclosure notifications, indicating active exploitation risk and lack of official patches.
Technical Context
The vulnerability is rooted in CWE-77 (Improper Neutralization of Special Elements used in a Command - 'Command Injection'), where user-supplied input from the Password parameter in /billing/test_accesscodelogin.php is passed unsanitized to OS command execution functions. Wifi-soft UniBox Controller is a network management and billing platform that handles authentication and access control. The vulnerability likely stems from PHP code that directly concatenates user input into system calls (exec(), system(), shell_exec(), or passthru()) without proper escaping or parameterized command execution. The affected file's purpose in testing access code logins suggests it may be a debug or administrative interface that inadequately validates cryptographic or authentication parameters before executing backend system commands.
Affected Products
Wifi-soft UniBox Controller versions up to and including 20250506 (date-based versioning indicates May 6, 2025 release). CPE would be structured as: cpe:2.3:a:wifi-soft:unibox_controller:*:*:*:*:*:*:*:* with version bounds <=20250506. Exact vendor name confirmation needed, but described as 'Wifi-soft' or similar. No specific patch version or later release documented as resolving this issue; vendor contact attempts did not yield response.
Remediation
Immediate actions: (1) Restrict network access to /billing/test_accesscodelogin.php via WAF or firewall rules, blocking external and unnecessary internal access; (2) Implement input validation and output encoding for all Password parameters using allowlist patterns; (3) Replace all OS command execution with parameterized APIs (e.g., proc_open with array arguments in PHP) to prevent injection; (4) Upgrade to a patched version once vendor releases one—monitor Wifi-soft security advisories and GitHub/vulnerability databases for version >20250506; (5) Consider disabling or removing the /billing/test_accesscodelogin.php endpoint if it is debug-only functionality; (6) Implement runtime command execution logging and monitoring to detect exploitation attempts. No official patch or vendor advisory link is available given non-response; third-party security patches or forks may emerge if community response occurs.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today