EUVD-2025-18358
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of the file /authentication/logout.php. The manipulation of the argument mac_address leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Analysis
Critical OS command injection vulnerability in Wifi-soft UniBox Controller affecting versions up to 20250506, exploitable through the mac_address parameter in /authentication/logout.php. An authenticated attacker can remotely execute arbitrary OS commands with high impact on confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, and the vendor has not responded to early disclosure attempts, significantly elevating real-world risk.
Technical Context
This vulnerability is rooted in CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection), where unsanitized user input (mac_address parameter) is passed to OS command execution functions without proper escaping or validation. The affected component is the /authentication/logout.php endpoint in Wifi-soft UniBox Controller, a network management appliance. The UniBox Controller is commonly deployed in enterprise WiFi infrastructure management scenarios. The vulnerability likely stems from PHP functions like exec(), system(), passthru(), or shell_exec() receiving unsanitized input from the mac_address GET/POST parameter, allowing an attacker to inject shell metacharacters (pipe, semicolon, backticks, command substitution syntax) to break out of the intended command context and execute arbitrary commands with the privilege level of the web server process (often root or system user in appliance contexts).
Affected Products
Wifi-soft UniBox Controller (CPE approximation: cpe:2.3:a:wifi-soft:unibox_controller:*:*:*:*:*:*:*:*) versions up to and including 20250506. No later patched versions identified in available intelligence. Affected file: /authentication/logout.php. Vulnerable parameter: mac_address. Deployment scope typically includes enterprise WiFi management appliances, access points, and controller nodes in SMB and enterprise networks. No specific vendor advisory or patch reference provided, indicating lack of vendor remediation response.
Remediation
Immediate remediation steps: (1) PATCH: Contact Wifi-soft directly or monitor for security updates; given vendor non-responsiveness, consider product replacement or migration to alternative WiFi management solutions; (2) WORKAROUND: Implement strict network segmentation—restrict access to the UniBox Controller management interface (port for /authentication/logout.php, typically 80/443) to trusted administrative networks only via firewall rules; (3) ACCESS CONTROL: Disable or remove default user accounts; enforce strong authentication policies; implement multi-factor authentication if supported; (4) DETECTION: Monitor for suspicious requests to /authentication/logout.php with unusual mac_address parameter values containing shell metacharacters (;, |, &, `, $(), etc.); (5) ISOLATION: If patch is unavailable, consider taking the affected controller offline and replacing with a patched or alternative solution; (6) AUDIT: Review logs for exploitation attempts; assess if unauthorized command execution has occurred. No vendor patch availability confirmed as of CVE disclosure date.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today