Planet WGR-500 CVE-2025-54400

Requires network access to the WGR-500 web management interface and valid low-privilege authentication (CVSS PR:L) - it is NOT unauthenticated. The specific trigger is the formPingCmd functionality: an attacker must submit a crafted series of HTTP requests with an oversized counts value used to compose the 'ping -c <counts> <ipaddr> 2>&1 > %s &' command string. Limiting factors: valid credentials are needed, the affected build is the specific firmware v1.3411b190912, and exposure depends on whether the management interface is reachable from the attacker's network position (internal/LAN by default for most SOHO routers unless WAN management is enabled).

This is a credible, actionable issue but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 HIGH) describes a network-reachable, low-complexity stack overflow requiring only low-privilege authentication, yielding full confidentiality/integrity/availability impact - consistent with router firmware where the web management plane runs as root and an overflow in a command-composing routine (ping -c <counts> <ipaddr>) plausibly leads to code execution. Publicly available exploit detail from Cisco Talos (TALOS-2025-2226) raises practical risk, but EPSS is modest at 0.73% (53rd percentile) and the CVE is NOT on CISA KEV, indicating no confirmed in-the-wild exploitation - publicly available exploit code exists but that is distinct from active exploitation. The dominant limiter is prevalence and the PR:L gate: the Planet WGR-500 is a niche SOHO/industrial router, and an attacker needs valid (even low-privilege) web credentials, which is a meaningful barrier against untargeted mass exploitation. Net: a real post-authentication RCE priority for the specific appliance owners, but low aggregate internet-wide risk. No signals materially conflict; the vendor CVSS and the described mechanics are internally consistent.

An attacker with low-privilege credentials to the WGR-500 web interface submits a series of crafted HTTP requests to the formPingCmd handler, supplying an oversized counts parameter that overruns a stack buffer while the firmware builds the 'ping -c <counts> <ipaddr> ...' command string. The overflow corrupts the stack and can redirect execution to attacker-controlled code running with the web service's (typically root) privileges, giving full control of the router. Public technical detail from Cisco Talos (TALOS-2025-2226) lowers the bar to reproduce.