PT-2026-36808

CVE-2025-13605

Published

2026-05-04

Updated

2026-05-04

Description by

CVSS 4.0

9.3

Critical

MetricsAV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions 3onedata modbus gateway device model GW1101-1D(RS-485)-TB-P (hardware version V2.2.0) versions prior to 3.0.59B2024080600R4353

Description Authenticated users can execute arbitrary shell commands with root privileges. This is possible by providing a malicious payload in the "IP address" field of the diagnosis test tools.

Recommendations Update to firmware version 3.0.59B2024080600R4353.

Exploitability

Fix

Impacts

Researchers

Jarosław Wawiórko

Łukasz Rybak

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers