Planet WGR-500 CVE-2025-54403

Exploitation requires the attacker to reach the WGR-500's swctrl functionality over the network and submit a request containing the new_password parameter with embedded command-injection payload. The CVSS vector's PR:L indicates low-privilege/authenticated access to this management function is required rather than fully anonymous access, which limits exploitation to users who can reach and interact with the authenticated password/configuration interface; no end-user interaction (UI:N) is needed. The attack is constrained to the specific affected firmware build 1.3411b190912 of the Planet WGR-500, further narrowing the exposed population.

This is a CWE-78 OS command injection in the swctrl functionality of Planet WGR-500 firmware via the new_password parameter, scored CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The network attack vector, low complexity, and complete C/I/A impact make successful exploitation highly damaging - resulting in arbitrary command execution on the device. The single limiting factor is PR:L, meaning the CVSS vector indicates some level of authentication/low privilege is required rather than fully unauthenticated access; the new_password parameter context suggests the injection sits within an authenticated password-management or administrative request path. Publicly available exploit code exists (reported by Cisco Talos, TALOS-2025-2227), which materially raises practical risk by lowering the skill barrier. However, no EPSS score and no CISA KEV status were provided in the input, so there is no signal of active widespread exploitation at this time - the available data shows POC availability, not confirmed in-the-wild use. Overall this is a genuinely high-severity, exploitable flaw, but real-world urgency is tempered by the low deployment footprint of the specific product and the low-privilege prerequisite; it is a priority for the limited population running this exact firmware rather than a broad internet-wide emergency.

An attacker with low-level access to the WGR-500 web/management interface sends a specially crafted network request to the swctrl functionality, embedding shell metacharacters in the new_password parameter. Because the input is passed unsanitized to an OS command, the injected payload executes with the privileges of the handling process, yielding arbitrary command execution on the device. Publicly available exploit code (Cisco Talos TALOS-2025-2227) demonstrates the technique, reducing the effort required to reproduce the attack.