3onedata modbus gateway root command injection patched
Authenticated attackers can execute arbitrary commands as root on 3onedata GW1101-1D modbus gateways via the diagnosis tool's IP address field; patched in firmware 3.0.59B2024080600R4353.
CERT Polska disclosed CVE-2025-13605, a command injection vulnerability in 3onedata modbus gateway device model GW1101-1D(RS-485)-TB-P running hardware version V2.2.0. The flaw allows authenticated users to execute arbitrary shell commands with root privileges by injecting malicious payloads into the IP address field of the device's built-in diagnosis test tools.
The vulnerability was responsibly disclosed by security researchers Jarosław Wawiórko and Łukasz Rybak. 3onedata has released firmware version 3.0.59B2024080600R4353 to address the issue. Organizations using affected modbus gateways in industrial environments should prioritize patching, as root-level command execution could enable lateral movement within operational technology networks.
Mentioned in this report
Detection guidance
Shell Metacharacters Injected into Network Diagnostic Command Arguments
Detects command injection via shell metacharacters embedded in IP/host arguments passed to ping/traceroute/nslookup style diagnostic utilities, consistent with CVE-2025-13605 exploitation of the 3onedata modbus gateway diagnosis test tool. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Metacharacters Injected into Network Diagnostic Command Arguments
id: dcd887f1-cbe0-53cc-b3d4-e44d939dae97
status: experimental
description: 'Detects execution of common network diagnostic binaries (ping, traceroute,
nslookup) with command lines containing shell metacharacters (;, |, &, `, $(), &&)
commonly used to inject arbitrary shell commands into a target/IP address field,
as seen in CVE-2025-13605 affecting 3onedata modbus gateway devices.
'
references:
- CVE-2025-13605
author: Vorant
tags:
- attack.t1059.004
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection_bin:
Image|endswith:
- /ping
- /traceroute
- /nslookup
- /tracepath
selection_meta:
CommandLine|contains:
- ;
- '|'
- '`'
- $(
- '&&'
- '||'
- '>/'
- <(
filter_benign:
CommandLine|contains:
- '# '
condition: selection_bin and selection_meta and not filter_benign
falsepositives:
- Legitimate scripts that pass shell operators to diagnostic wrapper scripts (rare
in production network appliances)
- Administrative debugging scripts invoking ping with piped output for logging
level: high
Shell Interpreter Spawned by Web Management or CGI Diagnostic Service
Detects a shell interpreter (/bin/sh, /bin/bash, /bin/ash) being spawned as a child of a web server or cgi-bin diagnostic process, indicative of command injection through a device's web-based network diagnosis tool such as the 3onedata modbus gateway IP field vulnerability (CVE-2025-13605). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Interpreter Spawned by Web Management or CGI Diagnostic Service
id: 8544fcd8-19d3-5f6d-b66c-b68c766a8fe2
status: experimental
description: 'Detects a shell process being launched by a web/cgi management daemon
process, consistent with exploitation of an embedded device diagnostic tool that
passes unsanitized input to a shell (CVE-2025-13605, 3onedata modbus gateway root
command injection).
'
references:
- CVE-2025-13605
author: Vorant
tags:
- attack.t1059.004
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- httpd
- lighttpd
- boa
- cgi
- webs
selection_child:
Image|endswith:
- /sh
- /bash
- /ash
- /dash
condition: selection_parent and selection_child
falsepositives:
- Legitimate CGI scripts on the device that intentionally invoke a shell for built-in
diagnostic or configuration functions
- Vendor firmware update or maintenance scripts triggered through the web UI
level: medium
Root-Level Command Execution Following Authenticated Session on Network Appliance
Detects an authenticated management session on a network/IoT appliance immediately followed by execution of a shell or unexpected system binary, suggesting abuse of valid credentials to trigger command injection in a device diagnostic feature such as CVE-2025-13605. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Root-Level Command Execution Following Authenticated Session on Network Appliance
id: 451ad2c7-e503-5714-809f-bf01d0660b5c
status: experimental
description: 'Detects execution of a shell process running as root shortly after an
authenticated web/management login on a network appliance, which may indicate a
valid but potentially abused account is being used to trigger command injection
in a built-in diagnostic tool (as in CVE-2025-13605 affecting 3onedata modbus gateways).
Correlate authentication events with immediate root shell spawning within the same
session window.
'
references:
- CVE-2025-13605
author: Vorant
tags:
- attack.t1078
- attack.initial_access
- attack.persistence
logsource:
category: process_creation
product: linux
detection:
selection_root_shell:
Image|endswith:
- /sh
- /bash
User: root
selection_parent_web:
ParentImage|contains:
- httpd
- lighttpd
- boa
- webs
condition: selection_root_shell and selection_parent_web
falsepositives:
- Administrators legitimately logging into the appliance web UI and using built-in
maintenance shell features
- Automated firmware or configuration backup jobs invoked via the web management interface
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2025-13605
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free