What is the CVSS score of CVE-2025-48826?

CVE-2025-48826 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 6.9%.

Is there a public PoC exploit available for CVE-2025-48826?

Yes, a public proof-of-concept exploit is available for CVE-2025-48826. Prioritise patching immediately. EPSS: 6.9%.

How to fix or mitigate CVE-2025-48826?

Within 24 hours, inventory all Planet WGR-500 devices, confirm which are running firmware 1.3411b190912, and verify no vendor-released patch has been published by checking Planet's security advisory page directly. Until then, restrict access to the web management interface to a dedicated, trusted administrative VLAN, immediately rotate any default or shared credentials to unique strong passwords, disable remote/WAN-side management, and change the default management port. Within 7 days, place affected routers behind firewall rules that permit management traffic only from authorized administrative hosts, enable logging and alerting on management-interface access and unusual HTTP request patterns, and review device logs for signs of tampering or unexpected reboots. Within 30 days, evaluate replacement with a supported router model or vendor if no patch emerges, formalize a firmware upgrade process to apply the vendor fix as soon as Planet releases it, and document these interim controls as compensating measures in your risk register with a named owner for periodic reassessment.

Planet WGR-500 CVE-2025-48826

HIGH

Use of Externally-Controlled Format String (CWE-134)

2025-10-07 talos-cna@cisco.com

Buffer Overflow Wgr 500 Firmware

8.8

CVSS 3.1 · Vendor: cisco

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to WGR-500 web UI (low-priv)
Delivery

Send crafted HTTP requests to formPingCmd
Exploit

Trigger format string memory corruption
Execution

Execute attacker-controlled code
Impact

Full compromise of gateway device

Vulnerability Assessment

Weakness	CWE CWE-134 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Format string safety
Exploitation Conditions	Exploitation requires network access to the Planet WGR-500 (firmware 1.3411b190912) web management interface and valid low-privilege authenticated credentials (CVSS PR:L), after which the attacker must reach the formPingCmd functionality and send a specific crafted series of HTTP requests - a single request is insufficient per the description. Limiting factors: the authentication prerequisite, the requirement to reach the management interface (typically LAN-side and not internet-exposed by default), and the restriction to the single affected firmware build. No special non-default product configuration beyond access to the ping command feature is indicated.
Impact	This is a serious but access-gated vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity attack with full CIA impact, but PR:L confirms the attacker must already hold low-privilege authenticated access to the device's web interface - this is not an unauthenticated flaw. Publicly available exploit code exists (confirmed via Cisco Talos report TALOS-2025-2228), which raises the practical risk, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation at time of analysis. The signals are therefore mostly consistent: a genuinely exploitable memory-corruption bug with public POC, moderated by an authentication requirement and by the niche deployment footprint of the Planet WGR-500 gateway. No SSVC decision data was provided. Net assessment: a real priority for anyone operating this specific device (especially where the web UI is exposed or default/weak credentials are in use), but lower urgency across a general fleet given the authentication prerequisite, absence of KEV/EPSS evidence, and limited product prevalence.
Exploit ScenarioDerived	An attacker with low-privilege credentials to the Planet WGR-500 web management interface sends a specially crafted series of HTTP requests to the formPingCmd endpoint, exploiting a format string flaw (CWE-134) to corrupt memory. Because the CVSS vector reports full confidentiality, integrity, and availability impact, successful exploitation can lead to code execution or device crash/compromise. A public proof-of-concept is available through Cisco Talos (TALOS-2025-2228), lowering the barrier to weaponization.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 6.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 08, 2026

Authenticated memory corruption in Planet WGR-500 firmware 1.3411b190912 allows a low-privileged attacker with access to the web management interface to corrupt process memory via a crafted format string in the formPingCmd functionality. The flaw rates CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring valid low-privilege credentials and a specific series of HTTP requests rather than a single call. Publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV) at time of analysis, and the attack surface is typically limited to LAN-side management interfaces rather than internet-exposed deployments.

RemediationAI

No vendor-released patch was identified at time of analysis, so remediation must center on reducing exposure of the management interface. First, confirm with Planet whether a fixed firmware build supersedes 1.3411b190912 and upgrade immediately if one exists; reference the Talos advisory TALOS-2025-2228 for vendor coordination details. Until a patch is confirmed, restrict access to the WGR-500 web management interface: place it on a dedicated management VLAN, block WAN-side access to the HTTP/HTTPS admin ports at the perimeter firewall, and use ACLs so only trusted administrative hosts can reach the UI - this trades off remote manageability but directly removes the CVSS AV:N attack path. Second, rotate the credentials of any low-privilege accounts and eliminate unnecessary user accounts, since the exploit requires valid authenticated access (PR:L); note that this is a compensating control only, as a legitimate low-privilege user could still trigger the flaw. Third, if the ping diagnostic feature is not operationally required, disable or otherwise unreachable-ify that functionality, though this may not be exposed as a configurable toggle and should be validated in a lab first. Finally, monitor device logs for repeated or anomalous formPingCmd requests and consider deploying it behind an authenticated reverse proxy that filters format-specifier characters in HTTP parameters as a defense-in-depth measure, recognizing that input filtering on embedded firmware is difficult to guarantee.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is a classic CWE-134 uncontrolled format string issue in the formPingCmd handler of the Planet WGR-500 wireless router firmware (CPE cpe:2.3:o:planet:wgr-500_firmware:1.3411b190912). The handler consumes user-supplied HTTP input and passes it into a formatting routine without proper format-specifier sanitization, allowing the attacker's input to be interpreted as a format string (e.g., %n/%s/%x style conversion specifiers). Because the affected code path parses attacker-controlled data as format directives, it can read from and write to arbitrary memory locations, producing memory corruption that in turn enables integrity and confidentiality impact (C:H/I:H/A:H) - including potential code execution in the httpd-style management process. The Talos intelligence report (TALOS-2025-2228) documents the formPingCmd path as the entry point, and the reported tags (Buffer Overflow, Wgr 500 Firmware) reflect the downstream buffer/memory corruption symptom accompanying the format-string root cause. The CVSS vector PR:L confirms the attacker must already hold valid low-privilege credentials, and the description indicates a series of requests is required to reliably trigger corruption.

Know when Wgr 500 Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (cisco) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Network-reachable web endpoint (AV:N) with low-complexity crafted requests (AC:L) but requires authenticated low-privilege access (PR:L); memory corruption on the device yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to memory corruption. An attacker can send a series of HTTP requests to trigger this vulnerability.

Executive ViewAI

Why It Matters

Planet WGR-500 wireless routers running firmware 1.3411b190912 contain a memory corruption flaw that can be triggered by anyone holding valid low-privilege credentials on the device's web management interface, enabling full takeover of the router. Because this device typically sits at the network edge routing and filtering traffic, a compromise could expose all internal systems and communications behind it. Publicly available exploit code increases the likelihood that even modestly skilled attackers will attempt to reproduce the attack, though it requires LAN-side access and valid credentials, which narrows the realistic threat to insiders, compromised endpoints, and anyone who has obtained default or shared admin logins.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict management interface access to a trusted administrative VLAN with firewall rules limiting source addresses; disable WAN/remote management; rotate default and shared credentials to unique strong passwords; change the default management port; monitor and alert on management-interface access and anomalous HTTP request sequences.

Threat Intelligence Overview

EPSS Score

6.9%

Top 6% exploitable

Prevalence

Low

niche SOHO/SMB networking gateway, limited enterprise footprint

Exploit

POC

Public exploit code exists

Data Quality

2 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 6.9%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +7

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.