CVE-2025-13605 Shell command injection in 3onedata GW1101-1D(RS-485)-TB-P modbus gateway
Authenticated attackers can execute arbitrary shell commands as root via the IP address field in the diagnosis tools of this Modbus gateway.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13605?
CVE-2025-13605 is a critical command injection vulnerability in 3onedata GW1101-1D(RS-485)-TB-P, published on 4 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
3onedata modbus gateway device model GW1101-1D(RS-485)-TB-P (hardware version V2.2.0) allows authenticated users to execute arbitrary shell commands in the context of the root user by providing payload in the "IP address" field of the diagnosis test tools. This issue has been resolved in firmware version 3.0.59B2024080600R4353
Weakness: CWE-78
Which versions are affected by CVE-2025-13605?
How do I fix CVE-2025-13605?
No fix has been published for CVE-2025-13605 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-13605 being exploited?
There is no known exploitation of CVE-2025-13605 in the wild and no public exploit code.
Sources
Also known as GHSA-v3mp-h9f4-c7mf.