3onedata Modbus Gateway Root Command Injection Flaw
An authenticated command injection bug in 3onedata GW1101-1D(RS-485)-TB-P modbus gateways lets attackers run root shell commands via the diagnosis tool's IP field.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of CVE-2025-13605, a vulnerability affecting 3onedata's GW1101-1D(RS-485)-TB-P Modbus gateway (hardware version V2.2.0). The flaw resides in the device's built-in diagnosis test tools, where an authenticated user can inject arbitrary shell commands through the 'IP address' input field, resulting in command execution with root privileges.
Because the affected device functions as an industrial Modbus-to-Ethernet gateway, exploitation could allow an attacker with valid credentials to pivot from the management interface into full control of the underlying OS, potentially enabling further lateral movement into connected OT/industrial networks. The vendor has released firmware version 3.0.59B2024080600R4353 to remediate the issue, and operators of this device should apply the update promptly.
No evidence of active exploitation was reported; the vulnerability was responsibly disclosed by researchers Jarosław Wawiórko and Łukasz Rybak through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Root-Privileged Process Spawning from Gateway Service
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects unexpected shell or command execution spawned by the Modbus gateway service process running as root, indicating successful exploitation of CVE-2025-13605. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Root-Privileged Process Spawning from Gateway Service
description: Detects suspicious process creation where the Modbus gateway service
(or related daemon) with root UID spawns a shell interpreter, script engine, or
remote access tool. Indicators of post-exploitation command execution in industrial
gateway context.
tags:
- attack.t1059
- attack.t1068
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- gw1101
- modbus-gw
- gateway-service
Image|endswith:
- /bin/sh
- /bin/bash
- /bin/dash
- /usr/bin/python
- /usr/bin/perl
- /usr/bin/nc
- /usr/bin/ncat
User: root
filter_init:
ParentImage|endswith:
- /init
- /systemd
condition: selection and not filter_init
falsepositives:
- Legitimate gateway firmware update scripts spawning shells as root
- System maintenance or health-check tools bundled in the device
level: high
id: 15a795dd-3072-591c-a3ce-782cdc596d2d
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2025-13605
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs