Planet WGR-500 CVE-2025-54406

Exploitation targets the formPingCmd functionality of the Planet WGR-500 web interface, specifically injecting OS commands through the 'counts' HTTP request parameter, delivered as a crafted series of HTTP requests. The CVSS vector's PR:L indicates valid authenticated access (at least a low-privileged account or session) to the device's management interface is required - this is the primary limiting factor and means the flaw is not exploitable by a fully unauthenticated remote attacker. No special user interaction is needed (UI:N). Realistic risk is further limited by whether the WGR-500 management interface is reachable by the attacker (LAN vs. internet-exposed) and by the fixed firmware version 1.3411b190912 being in use.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity command injection requiring low privileges (PR:L = authenticated), yielding full confidentiality, integrity, and availability impact. Publicly available exploit/proof-of-concept detail is referenced via the Talos report (TALOS-2025-2229), so the barrier to weaponization is low. However, there is NO CISA KEV listing and NO EPSS score was provided in the input, so there is no signal of active, widespread exploitation - exploitation status is 'publicly available exploit code exists' but not confirmed in-the-wild. SSVC-style framing: exploitation = PoC, automatable = likely (HTTP-reachable, low complexity) but gated by the PR:L authentication requirement, technical impact = total. The missing EPSS and absence from KEV, combined with the niche/low-footprint nature of the affected Planet WGR-500 device, suggest this is a genuine but comparatively low-urgency issue for most fleets versus a flaw in ubiquitous software - prioritize where this specific device is deployed and internet-exposed. Note the PR:L requirement meaningfully limits risk: an attacker needs valid (likely low-privileged) credentials or session access to the device's web interface first.

An attacker with valid low-privileged credentials to the Planet WGR-500 web management interface sends a specially crafted series of HTTP requests to the formPingCmd endpoint, injecting shell metacharacters via the 'counts' parameter. Because the parameter is passed to an OS command without sanitization, the injected commands execute on the device. Public exploit detail exists in the Talos report, lowering the effort required to reproduce the attack.