3onedata Modbus Gateway Root Command Injection Flaw

4 May 2026 medium vulnerability infrastructuremanufacturing

An authenticated command injection bug in 3onedata GW1101-1D(RS-485)-TB-P modbus gateways lets attackers run root shell commands via the diagnosis tool's IP field.

CERT Polska coordinated the disclosure of CVE-2025-13605, a vulnerability affecting 3onedata's GW1101-1D(RS-485)-TB-P Modbus gateway (hardware version V2.2.0). The flaw resides in the device's built-in diagnosis test tools, where an authenticated user can inject arbitrary shell commands through the 'IP address' input field, resulting in command execution with root privileges.

Because the affected device functions as an industrial Modbus-to-Ethernet gateway, exploitation could allow an attacker with valid credentials to pivot from the management interface into full control of the underlying OS, potentially enabling further lateral movement into connected OT/industrial networks. The vendor has released firmware version 3.0.59B2024080600R4353 to remediate the issue, and operators of this device should apply the update promptly.

No evidence of active exploitation was reported; the vulnerability was responsibly disclosed by researchers Jarosław Wawiórko and Łukasz Rybak through CERT Polska's coordinated vulnerability disclosure process.

Mentioned in this report

Vulnerabilities CVE-2025-13605

Detection guidance

Root-Privileged Process Spawning from Gateway Service

ATT&CK T1068

Detects unexpected shell or command execution spawned by the Modbus gateway service process running as root, indicating successful exploitation of CVE-2025-13605. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Root-Privileged Process Spawning from Gateway Service
description: Detects suspicious process creation where the Modbus gateway service
  (or related daemon) with root UID spawns a shell interpreter, script engine, or
  remote access tool. Indicators of post-exploitation command execution in industrial
  gateway context.
tags:
- attack.t1059
- attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - gw1101
    - modbus-gw
    - gateway-service
    Image|endswith:
    - /bin/sh
    - /bin/bash
    - /bin/dash
    - /usr/bin/python
    - /usr/bin/perl
    - /usr/bin/nc
    - /usr/bin/ncat
    User: root
  filter_init:
    ParentImage|endswith:
    - /init
    - /systemd
  condition: selection and not filter_init
falsepositives:
- Legitimate gateway firmware update scripts spawning shells as root
- System maintenance or health-check tools bundled in the device
level: high
id: 15a795dd-3072-591c-a3ce-782cdc596d2d
status: experimental
author: Vorant

Unauthorized Authentication to Industrial Modbus Gateway

ATT&CK T1078

Detects HTTP authentication attempts to Modbus gateway management interface from unusual source IPs or with repeated failed logins followed by successful access, suggesting credential compromise or brute-force exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unauthorized Authentication to Industrial Modbus Gateway
description: Detects successful HTTP authentication to Modbus gateway diagnostic or
  configuration endpoints (e.g., /login, /diag) preceded by multiple failed attempts
  from the same source, or from IPs not in expected management subnet. Indicates credential-based
  exploitation of CVE-2025-13605.
tags:
- attack.t1078
- attack.t1059
logsource:
  category: proxy
  product: http
detection:
  selection_attempt:
    url|contains:
    - /login
    - /auth
    - /diagnostic
    http_response_code:
    - 401
    - 403
  selection_success:
    url|contains:
    - /login
    - /auth
    - /diagnostic
    http_response_code: 200
    http_request_method: POST
  filter_expected_source:
    source_ip|startswith:
    - 192.168.
    - 10.0.
    - 172.16.
  condition: (selection_attempt and selection_success) and not filter_expected_source
falsepositives:
- Legitimate remote management from dynamic or cloud-based IP addresses
- IT personnel testing gateway access from outside primary management subnet
level: medium
id: b669cf24-3b90-5462-adda-7dab666f9ed1
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2025-13605

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free