CVE-2025-13605

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13605", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2025-11-24T14:44:56.542Z", "datePublished": "2026-05-04T14:52:39.300Z", "dateUpdated": "2026-05-04T15:28:56.851Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "GW1101-1D(RS-485)-TB-P", "vendor": "3onedata", "versions": [{"lessThan": "3.0.59B2024080600R4353", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jaros\u0142aw Wawi\u00f3rko"}, {"lang": "en", "type": "finder", "value": "\u0141ukasz Rybak"}], "datePublic": "2026-05-04T14:50:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "3onedata modbus gateway device model&nbsp;GW1101-1D(RS-485)-TB-P (hardware version V2.2.0)&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">allows authenticated users to execute arbitrary shell commands in the context of the root user by providing payload in the \"IP address\" field of the diagnosis test tools.<br></span>This issue has been resolved in firmware version 3.0.59B2024080600R4353"}], "value": "3onedata modbus gateway device model\u00a0GW1101-1D(RS-485)-TB-P (hardware version V2.2.0)\u00a0allows authenticated users to execute arbitrary shell commands in the context of the root user by providing payload in the \"IP address\" field of the diagnosis test tools.\nThis issue has been resolved in firmware version 3.0.59B2024080600R4353"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-05-04T14:52:39.300Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2026/05/CVE-2025-13605"}], "source": {"discovery": "EXTERNAL"}, "title": "Shell command injection in 3onedata GW1101-1D(RS-485)-TB-P modbus gateway", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-04T15:28:34.977201Z", "id": "CVE-2025-13605", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T15:28:56.851Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13605", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-04T15:28:34.977201Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T15:28:44.757Z"}}], "cna": {"title": "Shell command injection in 3onedata GW1101-1D(RS-485)-TB-P modbus gateway", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jaros\u0142aw Wawi\u00f3rko"}, {"lang": "en", "type": "finder", "value": "\u0141ukasz Rybak"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "3onedata", "product": "GW1101-1D(RS-485)-TB-P", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.59B2024080600R4353", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-05-04T14:50:00.000Z", "references": [{"url": "https://cert.pl/en/posts/2026/05/CVE-2025-13605", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "3onedata modbus gateway device model\u00a0GW1101-1D(RS-485)-TB-P (hardware version V2.2.0)\u00a0allows authenticated users to execute arbitrary shell commands in the context of the root user by providing payload in the \"IP address\" field of the diagnosis test tools.\nThis issue has been resolved in firmware version 3.0.59B2024080600R4353", "supportingMedia": [{"type": "text/html", "value": "3onedata modbus gateway device model&nbsp;GW1101-1D(RS-485)-TB-P (hardware version V2.2.0)&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">allows authenticated users to execute arbitrary shell commands in the context of the root user by providing payload in the \"IP address\" field of the diagnosis test tools.<br></span>This issue has been resolved in firmware version 3.0.59B2024080600R4353", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-05-04T14:52:39.300Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13605", "state": "PUBLISHED", "dateUpdated": "2026-05-04T15:28:56.851Z", "dateReserved": "2025-11-24T14:44:56.542Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-05-04T14:52:39.300Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "GW1101-1D(RS-485)-TB-P", "vendor": "3onedata", "versions": [{"lessThan": "3.0.59B2024080600R4353", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "3onedata modbus gateway device model\u00a0GW1101-1D(RS-485)-TB-P (hardware version V2.2.0)\u00a0allows authenticated users to execute arbitrary shell commands in the context of the root user by providing payload in the \"IP address\" field of the diagnosis test tools.\nThis issue has been resolved in firmware version 3.0.59B2024080600R4353"}, {"lang": "es", "value": "El dispositivo gateway Modbus 3onedata modelo GW1101-1D(RS-485)-TB-P (versi\u00f3n de hardware V2.2.0) permite a usuarios autenticados ejecutar comandos shell arbitrarios en el contexto del usuario root al proporcionar payload en el campo de la 'direcci\u00f3n IP' de las herramientas de prueba de diagn\u00f3stico. Este problema ha sido resuelto en la versi\u00f3n de firmware 3.0.59B2024080600R4353."}], "id": "CVE-2025-13605", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13605", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-04T15:28:34.977201Z", "version": "2.0.3"}}]}, "published": "2026-05-04T15:16:02.630", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2026/05/CVE-2025-13605"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.0.59B2024080600R4353)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "GW1101-1D(RS-485)-TB-P", "source": "cna", "vendor": "3onedata"}, "product": "gw1101-1d(rs-485)-tb-p", "vendor": "3onedata"}], "created": "2026-05-04T17:00:04.762186+00:00", "updated": "2026-05-04T19:44:08.652197+00:00", "vendors": ["3onedata", "3onedata$PRODUCT$gw1101-1d(rs-485)-tb-p"]}