Planet WGR-500 CVE-2025-54404

Exploitation requires reaching the swctrl functionality of the WGR-500 web/management interface and submitting a crafted request whose new_device_name parameter carries injected OS command content; the device must be running firmware v1.3411b190912. The primary limiting factor is authentication: the CVSS PR:L metric indicates a valid low-privilege account (or an otherwise accessible authenticated session to the management plane) is needed, so this is not a pre-auth internet-wide drive-by. No special non-default feature toggle is named in the description beyond use of the swctrl device-naming function, and no user interaction is required (UI:N). Real-world reach is further bounded by whether the management interface is exposed to attacker-controlled networks versus a restricted LAN/management VLAN.

This is a credible operational priority, not merely a high-CVSS paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity command injection requiring only low-level privileges and no user interaction, with full high impact across confidentiality, integrity and availability (C:H/I:H/A:H) - consistent with CWE-78 OS command injection yielding arbitrary command execution. Publicly available exploit code exists (reported by Cisco Talos, TALOS-2025-2227), which raises the practical exploitability above a theoretical flaw. However, the vulnerability is NOT in CISA KEV and no EPSS score was provided in the input, so there is no confirmation of active or widespread in-the-wild exploitation - the current signal is 'exploit code available' rather than 'actively exploited.' The PR:L metric indicates authentication is required, which meaningfully limits mass exploitation to attackers who already possess valid (even low-privilege) credentials or can reach an exposed management interface. Net: treat as high-priority for the specific population that runs this device, tempered by the fact that real-world blast radius depends on how exposed the swctrl/management interface is and on the device's limited deployment footprint. No SSVC decision data was supplied in the input, so automatable/technical-impact framing cannot be independently cited.

An attacker with low-privilege authenticated access to the Planet WGR-500 management interface submits a crafted network request to the swctrl functionality, injecting shell metacharacters into the new_device_name parameter. The injected OS commands execute on the device, giving the attacker arbitrary command execution and effective control of the router. Public exploit code for this issue exists (Cisco Talos TALOS-2025-2227), lowering the skill barrier to reproduce the attack.