CVE-2025-13605: Shell command injection in 3onedata GW1101-1D(RS-485)-TB-P modbus gateway

Severity: critical (CVSS 9.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-04 · updated 2026-10-07
Weakness: CWE-78

Description

3onedata modbus gateway device model GW1101-1D(RS-485)-TB-P (hardware version V2.2.0) allows authenticated users to execute arbitrary shell commands in the context of the root user by providing payload in the "IP address" field of the diagnosis test tools. This issue has been resolved in firmware version 3.0.59B2024080600R4353

Affected products

3onedata GW1101-1D(RS-485)-TB-P: before 3.0.59B2024080600R4353 — fixed in 3.0.59B2024080600R4353

How to fix

Upgrade to a fixed version: 3onedata GW1101-1D(RS-485)-TB-P 3.0.59B2024080600R4353. Check the vendor advisory for mitigations.

References

https://cert.pl/en/posts/2026/05/CVE-2025-13605

Get alerted when CVE-2025-13605 or the next vulnerability affects your stack