Planet WGR-500 CVE-2025-54399

Exploitation requires network reachability to the Planet WGR-500 web management interface and low-privilege authenticated access (CVSS PR:L) sufficient to invoke the formPingCmd diagnostic function; the attacker must supply a crafted ipaddr parameter across a series of HTTP requests to overflow the stack buffer used to build the 'ping -c <counts> <ipaddr> 2>&1 > %s &' command string. Limiting factors: the device must expose its management interface to the attacker, valid credentials (or default/weak credentials) are needed because exploitation is not unauthenticated, and only the specific firmware build v1.3411b190912 is confirmed affected. No end-user interaction is required (UI:N).

This is a stack-based buffer overflow (CWE-121) in the formPingCmd handler of the Planet WGR-500 router, reachable over the network via a crafted series of HTTP requests against the ipaddr parameter used to build a 'ping -c <counts> <ipaddr>' command string. The provided CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) indicates a network-reachable, low-complexity attack requiring low-level authentication, with full confidentiality, integrity, and availability impact - consistent with code execution on an embedded device. Publicly available exploit code exists (reported by Cisco Talos, TALOS-2025-2226), which materially raises practical risk over a theoretical finding. However, this CVE is NOT listed in CISA KEV, so there is no confirmation of active exploitation; the signals therefore point to a proven-exploitable but not-yet-widely-weaponized issue. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The PR:L metric means an attacker needs some authenticated access to the device (consistent with a web-admin ping diagnostic feature), which tempers the raw score - this limits mass unauthenticated exploitation but is weak protection given default/weak router credentials are common. Net: a real and credible priority for anyone running this specific device, but its real-world urgency is bounded by the niche deployment footprint and the authentication prerequisite rather than by any evidence of mass exploitation.

An attacker with access to the WGR-500 web management interface (PR:L) authenticates and submits a specially crafted series of HTTP requests to the formPingCmd endpoint, supplying an overly long or malformed ipaddr value that overflows a fixed-size stack buffer while the device composes the ping command string. Public exploit/PoC details are available via Cisco Talos (TALOS-2025-2226), lowering the bar to reliable code execution. Successful exploitation yields full compromise of the router (C:H/I:H/A:H).