Planet WGR-500 CVE-2025-54402

Exploitation requires network access to the HTTP management interface of a Planet WGR-500 running firmware v1.3411b190912, plus low-privilege authentication (CVSS PR:L) to reach the formPingCmd (ping diagnostic) functionality. The specific trigger is supplying crafted oversized values in the combined submit-url and ipaddr request parameters to overflow a stack buffer. Limiting factors: the attacker must be able to reach the web admin interface and must hold valid (even low-level) credentials or an authenticated session, so devices that do not expose the management UI to attacker-reachable networks and that enforce strong authentication are substantially harder to exploit; the flaw is tied to this exact firmware build.

Signals are largely consistent and point to a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack that requires low-level authentication (PR:L) and yields full compromise (C:H/I:H/A:H), consistent with memory-corruption-to-code-execution on an embedded router. Publicly available exploit code exists (reported via Cisco Talos, TALOS-2025-2226), which raises practical risk because the barrier to weaponization is lower. However, there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active, in-the-wild exploitation and no quantitative exploitation-probability signal to corroborate the POC. The key tempering factor is PR:L: an attacker needs valid (even low-privilege) credentials or an authenticated session to the device web UI, which limits mass unauthenticated exploitation. Net: a real, actionable priority for anyone running this specific Planet device - patch/mitigate - but not a drop-everything internet-wide emergency given the authentication requirement, absence of KEV, and the product's limited deployment footprint.

An attacker with low-privilege access to the WGR-500 web management interface (or who can reach it and use default/weak credentials) sends a crafted series of HTTP requests to the formPingCmd endpoint, supplying oversized values in the combined submit-url and ipaddr parameters to overflow a stack buffer. This corrupts the stack and enables arbitrary code execution on the router, fully compromising the device. Public exploit code for this flaw already exists (Cisco Talos TALOS-2025-2226), lowering the effort required to reproduce the attack.