Full Report
OS Command Injection vulnerability (CVE-2025-13605) has been found in 3onedata GW1101-1D(RS-485)-TB-P modbus gateways.
Analysis Summary
# Vulnerability: OS Command Injection in 3onedata Modbus Gateways
## CVE Details
- **CVE ID:** CVE-2025-13605
- **CVSS Score:** Not explicitly provided in the source (However, Command Injection with root privileges typically rates as **High/Critical**)
- **CWE:** CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
## Affected Systems
- **Products:** 3onedata Modbus Gateway (Model: GW1101-1D(RS-485)-TB-P)
- **Versions:** All firmware versions prior to 3.0.59B2024080600R4353
- **Configurations:** Hardware version V2.2.0
## Vulnerability Description
An OS command injection vulnerability exists within the web management interface of the 3onedata gateway. The flaw is located in the "diagnosis test tools" functionality. Specifically, the "IP address" input field does not properly neutralize special elements. An authenticated user can inject malicious payloads into this field, leading to the execution of arbitrary shell commands with **root** privileges on the underlying operating system.
## Exploitation
- **Status:** PoC described; reported via coordinated vulnerability disclosure.
- **Complexity:** Low (requires authenticated access to the web interface).
- **Attack Vector:** Network (Web UI).
## Impact
- **Confidentiality:** High (Total access to device configuration and system files).
- **Integrity:** High (Ability to modify system settings, firmware, or intercept data).
- **Availability:** High (Ability to shut down or brick the device).
## Remediation
### Patches
- **Update to Version 3.0.59B2024080600R4353 or later.** This version contains the necessary fixes to sanitize user input in the diagnostic tool fields.
### Workarounds
- **Restrict Access:** Ensure the gateway management interface is not accessible via the public internet.
- **Network Segmentation:** Place the gateway on a management VLAN with restricted access.
- **Principle of Least Privilege:** Change default credentials and limit the number of users with access to the web management interface to mitigate the risk of authenticated exploitation.
## Detection
- **Indicators of Compromise:** Review device logs for unusual characters (e.g., `;`, `|`, `&`, `$()`) submitted within the diagnostic tool logs or IP address fields.
- **Detection methods:** Monitor for unauthorized "root" level changes or unexpected outbound network connections from the gateway device that could signify a reverse shell.
## References
- **Vendor Advisory:** hxxps://www.3onedata[.]com/
- **CERT Polska Advisory:** hxxps://cert[.]pl/en/posts/2026/05/CVE-2025-13605/
- **CVE Record:** hxxps://www.cve[.]org/CVERecord?id=CVE-2025-13605