Planet WGR-500 CVE-2025-54405

Exploitation requires authenticated access (PR:L) to the Planet WGR-500 management web interface and the ability to reach the formPingCmd functionality, which is reached via a specific series of HTTP requests manipulating the ipaddr request parameter. The limiting factor is the authentication requirement - the attacker must hold valid low-privilege credentials or session to the device web UI; there is no unauthenticated path per the CVSS vector. Affected deployment is specifically Planet WGR-500 firmware v1.3411b190912; no user interaction is required (UI:N) once authenticated.

Signals are moderately consistent and point to a real but not top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable exploitation with low complexity but requires at least low-level privileges (PR:L), meaning the attacker must already be authenticated to the WGR-500 web interface - this materially lowers the risk versus an unauthenticated flaw despite the high 8.8 base score. POC/exploit code is publicly available (per the Cisco Talos TALOS-2025-2229 report), which raises practical exploitability, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation at this time. The limiting factor of required authentication combined with the product's narrow deployment footprint suggests this is an opportunistic/targeted risk (e.g., post-authentication privilege escalation to full device compromise) rather than a mass-exploited internet-wide threat. EPSS is MISSING and cannot be used to quantify exploitation probability - this should be verified against the current FIRST.org EPSS feed before final prioritization.

An attacker who has obtained valid (even low-privileged) credentials to the Planet WGR-500 management web interface sends a crafted series of HTTP requests to the formPingCmd endpoint, injecting shell metacharacters into the ipaddr parameter. Because the parameter is passed to an OS command without sanitization, the injected commands execute on the underlying device, yielding arbitrary command execution. A public exploit/POC exists via Cisco Talos (TALOS-2025-2229), making reproduction straightforward for an authenticated attacker.