Planet WGR-500 CVE-2025-54401

Exploitation requires network reachability to the WGR-500 HTTP management interface and valid authenticated access to it (CVSS PR:L), after which the attacker sends a crafted series of HTTP requests to the formPingCmd functionality, specifically abusing the submit-url request parameter to overflow a stack buffer. Limiting factors: the attacker must hold at least low-privilege credentials (so default-credential, weak-password, or post-authentication positions are the realistic entry), and the device is a specific firmware build (v1.3411b190912); no user interaction is needed (UI:N) and complexity is low (AC:L), so once credentialed the overflow is reliably triggerable against the management interface.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw requiring low-level privileges (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with authenticated remote code execution on a network router. Publicly available exploit code exists (referenced via the Talos report), which raises practical risk, but this is NOT the same as active exploitation: the CVE is not listed in CISA KEV and no EPSS score was provided in the input, so exploitation-in-the-wild cannot be asserted. No SSVC decision data was supplied. The key tension is that PR:L requires the attacker to already hold some authenticated access to the device's web interface, which meaningfully gates the attack despite the network vector; combined with the product's niche footprint, this reads as a genuine high-severity RCE for exposed/credentialed-adversary scenarios rather than a mass-exploitation priority. EPSS and KEV data are absent, so widespread-exploitation likelihood is unverified.

An attacker with valid (or weak/default) credentials to the WGR-500 web management interface sends a specially crafted series of HTTP requests to the formPingCmd handler, overflowing a stack buffer via the submit-url parameter. Because public exploit/proof-of-concept detail exists through the Talos report, a credentialed or adjacent attacker could achieve arbitrary code execution on the router. The low attack complexity (AC:L) means the overflow triggers reliably once the request format is known.