CVE-2025-13605 3onedata CVE debrief

Who should care

Defenders responsible for 3onedata modbus gateway devices, particularly those using model GW1101-1D(RS-485)-TB-P with hardware version V2.2.0, should assess exposure and apply the firmware update.

Why it matters

CVE-2025-13605 is a critical vulnerability in 3onedata modbus gateway devices, allowing authenticated users to execute arbitrary shell commands as root. Defenders should prioritize firmware updates and monitor for suspicious activity.

• Authenticated users can execute arbitrary shell commands as root
• Potential for lateral movement and further exploitation
• Need for immediate firmware update to version 3.0.59B2024080600R4353

Technical summary

The 3onedata modbus gateway device model GW1101-1D(RS-485)-TB-P (hardware version V2.2.0) has a vulnerability allowing authenticated users to execute arbitrary shell commands as the root user by providing a payload in the 'IP address' field of the diagnosis test tools. This issue has been resolved in firmware version 3.0.59B2024080600R4353. The vulnerability has a CVSS score of 9.3 and is considered critical. Defenders should prioritize firmware updates and monitor for suspicious activity on affected devices to mitigate potential operational impacts.

Defensive priority

High

Recommended defensive actions

• Review and apply firmware update 3.0.59B2024080600R4353 for GW1101-1D(RS-485)-TB-P
• Restrict access to diagnosis test tools to minimize exposure
• Monitor for suspicious activity on affected devices
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in 3onedata modbus gateway device model GW1101-1D(RS-485)-TB-P. The issue allows authenticated users to execute arbitrary shell commands as the root user. It has been resolved in firmware version 3.0.59B2024080600R4353.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.