3onedata GW1101-1D gateway command injection enables root execution
3onedata GW1101-1D modbus gateway contains authenticated command injection vulnerability (CVE-2025-13605) allowing root-level code execution via diagnosis tool IP field, patched in firmware 3.0.59B2024080600R4353.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2025-13605, a command injection vulnerability affecting 3onedata GW1101-1D(RS-485)-TB-P modbus gateway devices running hardware version V2.2.0. The flaw allows authenticated users to execute arbitrary shell commands with root privileges by injecting malicious payloads into the IP address field of the device's diagnosis test tools. This vulnerability impacts industrial environments where modbus gateways are commonly deployed for SCADA and ICS communications.
The vendor has released firmware version 3.0.59B2024080600R4353 to address the issue. Organizations using affected 3onedata modbus gateways should prioritize patching, as authenticated access combined with root-level command execution presents a significant risk in operational technology environments. The vulnerability was responsibly reported by Jarosław Wawiórko and Łukasz Rybak through CERT Polska's coordinated vulnerability disclosure program.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2025-13605
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs