3onedata GW1101-1D Modbus Gateway EUVD-2025-209614

Upgrade to firmware version 3.0.59B2024080600R4353 or later, available from 3onedata. This is the vendor-confirmed fix version that resolves the command injection vulnerability. For environments unable to immediately patch, implement network-based compensating controls: (1) Restrict administrative interface access to dedicated management VLANs with strict IP whitelisting, eliminating adjacent network access paths. (2) Disable or remove diagnostic test tool functionality if not operationally required - this eliminates the attack surface entirely but may impact troubleshooting capabilities. (3) Implement command execution monitoring/logging on the device if supported, to detect injection attempts (though this provides detection, not prevention). (4) Enforce principle of least privilege by creating read-only operator accounts instead of sharing full administrative credentials, though this may limit legitimate administrative functions. Verify patch application by checking firmware version in device management interface post-upgrade. Reference CERT-PL advisory at https://cert.pl/en/posts/2026/05/CVE-2025-13605 for additional vendor guidance.