Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Properly tear down vGIC upon failure to create a vCPU If kvmarchvcpucreate fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl while leaving the vGIC vCPU data initialized. Note...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2capsendcmd After the hci sync command releases l2capconn, the hci receive data work queue references the released l2capconn when sending to the upper layer. Add hci dev lock to...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue When the task management thread processes reply queues while the reset thread resets them, the task management thread accesses an invalid queue ID 0xFFFF, s...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: enetc: VFs do not support HWTSTAMPTXONESTEPSYNC In fact, ENETC VFs do not support HWTSTAMPTXONESTEPSYNC because only ENETC PF can access PMaINGLESTEP registers. If VFs are used to test one-step timestamp, a crash occurs; the...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ARM: dts: bcm2711: Fix xHCI power-domain During s2idle tests on the Raspberry CM4, the VPU firmware always crashes upon resume of the xHCI power-domain: root@raspberrypi:/sys/power echo freeze state 70.724347 xhcisuspend finished...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer for these events points to an enqueue operation occurring at the time of an error on xHCI 1.1+ HCs, or it is NULL on older ones. By the time we proce...

CVE-2025-6104

A vulnerability, which was classified as critical, was found in Wifi-soft UniBox Controller up to 20250506. This affects an unknown part of the file /billing/pmscheck.php. The manipulation of the argument ipaddress leads to os command injection. It is possible to initiate the attack remotely. The...

CVE-2025-6104 Wifi-soft UniBox Controller pms_check.php os command injection

A vulnerability, which was classified as critical, was found in Wifi-soft UniBox Controller up to 20250506. This affects an unknown part of the file /billing/pmscheck.php. The manipulation of the argument ipaddress leads to os command injection. It is possible to initiate the attack remotely. The...

CVE-2025-6104

CVE-2025-6104 affects Wifi-soft UniBox Controller up to 20250506. The vulnerability is an OS command injection in the /billing/pms_check.php handling of the ipaddress argument. It can be triggered remotely, with exploit details publicly disclosed. Remediation guidance in PT-2025-25515 suggests re...

CVE-2025-6103

A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functionality of the file /billing/testaccesscodelogin.php. The manipulation of the argument Password leads to os command injection. The attack m...

CVE-2025-6102

A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of the file /authentication/logout.php. The manipulation of the argument macaddress leads to os command injection. The attack can be launched...

CVE-2025-6103 Wifi-soft UniBox Controller test_accesscodelogin.php os command injection

A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functionality of the file /billing/testaccesscodelogin.php. The manipulation of the argument Password leads to os command injection. The attack m...

CVE-2025-6103 Wifi-soft UniBox Controller test_accesscodelogin.php os command injection

A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functionality of the file /billing/testaccesscodelogin.php. The manipulation of the argument Password leads to os command injection. The attack m...

CVE-2025-6102 Wifi-soft UniBox Controller logout.php os command injection

A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of the file /authentication/logout.php. The manipulation of the argument macaddress leads to os command injection. The attack can be launched...

CVE-2025-6103: Improper Neutralization of Special Elements used in an OS Command

A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functionality of the file /billing/testaccesscodelogin.php. The manipulation of the argument Password leads to os command injection. The attack m...

Wifisoft UniBox Controller security vulnerability

Wifisoft UniBox Controller is a small smart access controller from Wifisoft Corporation, USA. A security vulnerability exists in Wifisoft UniBox Controller 20250506 and prior versions, which stems from an os command injection issue that could lead to the execution of arbitrary commands...

CVE-2025-6104: Improper Neutralization of Special Elements used in an OS Command

A vulnerability, which was classified as critical, was found in Wifi-soft UniBox Controller up to 20250506. This affects an unknown part of the file /billing/pmscheck.php. The manipulation of the argument ipaddress leads to os command injection. It is possible to initiate the attack remotely. The...

Wifisoft UniBox Controller Command Injection Vulnerability

Wifisoft UniBox Controller is a small smart access controller from Wifisoft Corporation, USA. A command injection vulnerability exists in Wifisoft UniBox Controller 20250506 and prior versions, which stems from an os command injection issue that could lead to the execution of arbitrary commands...

CVE-2025-6102: Improper Neutralization of Special Elements used in an OS Command

A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of the file /authentication/logout.php. The manipulation of the argument macaddress leads to os command injection. The attack can be launched...

PT-2025-25513 · Wifi Soft · Wifi-Soft Unibox Controller

Name of the Vulnerable Software and Affected Versions: Wifi-soft UniBox Controller versions up to 20250506 Description: A critical vulnerability was found in the Wifi-soft UniBox Controller, affecting an unknown functionality of the file /authentication/logout.php. The manipulation of the mac...