Wgr 500 Firmware
Monthly
Command injection in the Planet WGR-500 wireless router (firmware v1.3411b190912) allows authenticated attackers to execute arbitrary OS commands via a crafted series of HTTP requests targeting the 'counts' parameter of the formPingCmd functionality. Publicly available exploit code exists (Talos report TALOS-2025-2229), and the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability requires valid low-privileged credentials on the device's management interface, limiting its exploitability to authenticated users who can reach the web interface.
OS command injection in the formPingCmd handler of Planet WGR-500 firmware v1.3411b190912 allows an authenticated remote attacker to execute arbitrary commands on the device by sending a crafted series of HTTP requests that manipulate the `ipaddr` parameter. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires valid low-privilege credentials or an existing web UI session but no user interaction, and yields high confidentiality, integrity, and availability impact. Publicly available exploit code exists (documented in Cisco Talos advisory TALOS-2025-2229); there is currently no evidence of confirmed active exploitation (CISA KEV), and the primary risk driver is the presence of an authenticated attack surface on internet- or LAN-exposed management interfaces.
Authenticated OS command injection in the swctrl device-naming function of Planet WGR-500 firmware v1.3411b190912 allows a low-privileged user with access to the management interface to execute arbitrary commands on the underlying operating system via the `new_device_name` parameter. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported at time of analysis. The vulnerability requires a valid low-privilege session (CVSS PR:L) and network reachability to the device's management plane, making exposure dependent on whether the interface is internet-facing or restricted to a management VLAN.
OS command injection in the swctrl functionality of Planet WGR-500 firmware build 1.3411b190912 allows a low-privileged, network-reachable user to execute arbitrary OS commands by submitting a crafted request that embeds shell metacharacters in the `new_password` parameter, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8). Authentication is required at the low-privilege level per the CVSS vector (PR:L), so exposure is limited to users who can reach and interact with the authenticated password/configuration interface rather than fully anonymous attackers, and the flaw is scoped to this specific firmware build. Publicly available exploit code exists (publicly available exploit code exists), but there is no confirmation of active exploitation (CISA KEV) at time of analysis, and no vendor-released patch was identified in the available data.
Stack-based buffer overflows in the formPingCmd functionality of Planet WGR-500 firmware v1.3411b190912 allow a remote attacker with low-privilege authentication (CVSS PR:L) to corrupt stack memory by sending HTTP requests that combine oversized values in the submit-url and ipaddr parameters, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). Publicly available exploit information was published by Cisco Talos (TALOS-2025-2226), and no confirmation of active exploitation (CISA KEV) was found at time of analysis. Attackers must first reach the router's web management interface and hold valid credentials or an authenticated session, so exposure is bounded to devices with the admin UI reachable from untrusted networks.
Authenticated stack-based buffer overflow in Planet WGR-500 firmware v1.3411b190912 allows remote attackers with low-privilege credentials to achieve full compromise via crafted HTTP requests to the formPingCmd functionality, specifically the submit-url parameter. The vulnerability requires network access to the device's HTTP management interface and valid authentication (CVSS PR:L), but no user interaction, and grants high confidentiality, integrity, and availability impact. Publicly available exploit code exists, increasing the risk for unpatched devices exposed to untrusted networks.
A stack-based buffer overflow in the formPingCmd handler of the Planet WGR-500 wireless router (firmware v1.3411b190912) lets an authenticated remote attacker crash or potentially execute code by submitting crafted HTTP requests with an oversized `counts` parameter. The flaw affects the web management interface, which normally sits on the LAN; exploitation requires network reachability to that interface plus valid low-privilege credentials (CVSS PR:L), so it is not unauthenticated. Publicly available exploit code exists and a Talos advisory (TALOS-2025-2226) documents the issue, but it is not in CISA KEV and EPSS is modest at 0.73% (53rd percentile) - a credible, actionable issue but not an emergency.
Stack-based buffer overflows in the formPingCmd diagnostic handler of the Planet WGR-500 wireless router (firmware v1.3411b190912) let a network-reachable, low-privilege authenticated attacker (CVSS PR:L, UI:N) corrupt the stack by sending a crafted series of HTTP requests containing an oversized ipaddr parameter, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw (CWE-121) stems from unsafe concatenation of the ipaddr value into the shell command string "ping -c <counts> <ipaddr> 2>&1 > %s &", so successful exploitation can redirect execution and potentially achieve remote code execution in the context of the router's web service. Publicly available exploit code exists (disclosed via Cisco Talos TALOS-2025-2226), though CISA KEV status is not indicated; exploitation requires the management interface to be exposed and valid credentials or default/weak credentials to reach the authenticated diagnostic function.
Authenticated memory corruption in Planet WGR-500 firmware 1.3411b190912 allows a low-privileged attacker with access to the web management interface to corrupt process memory via a crafted format string in the formPingCmd functionality. The flaw rates CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring valid low-privilege credentials and a specific series of HTTP requests rather than a single call. Publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV) at time of analysis, and the attack surface is typically limited to LAN-side management interfaces rather than internet-exposed deployments.
Command injection in the Planet WGR-500 wireless router (firmware v1.3411b190912) allows authenticated attackers to execute arbitrary OS commands via a crafted series of HTTP requests targeting the 'counts' parameter of the formPingCmd functionality. Publicly available exploit code exists (Talos report TALOS-2025-2229), and the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability requires valid low-privileged credentials on the device's management interface, limiting its exploitability to authenticated users who can reach the web interface.
OS command injection in the formPingCmd handler of Planet WGR-500 firmware v1.3411b190912 allows an authenticated remote attacker to execute arbitrary commands on the device by sending a crafted series of HTTP requests that manipulate the `ipaddr` parameter. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires valid low-privilege credentials or an existing web UI session but no user interaction, and yields high confidentiality, integrity, and availability impact. Publicly available exploit code exists (documented in Cisco Talos advisory TALOS-2025-2229); there is currently no evidence of confirmed active exploitation (CISA KEV), and the primary risk driver is the presence of an authenticated attack surface on internet- or LAN-exposed management interfaces.
Authenticated OS command injection in the swctrl device-naming function of Planet WGR-500 firmware v1.3411b190912 allows a low-privileged user with access to the management interface to execute arbitrary commands on the underlying operating system via the `new_device_name` parameter. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported at time of analysis. The vulnerability requires a valid low-privilege session (CVSS PR:L) and network reachability to the device's management plane, making exposure dependent on whether the interface is internet-facing or restricted to a management VLAN.
OS command injection in the swctrl functionality of Planet WGR-500 firmware build 1.3411b190912 allows a low-privileged, network-reachable user to execute arbitrary OS commands by submitting a crafted request that embeds shell metacharacters in the `new_password` parameter, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8). Authentication is required at the low-privilege level per the CVSS vector (PR:L), so exposure is limited to users who can reach and interact with the authenticated password/configuration interface rather than fully anonymous attackers, and the flaw is scoped to this specific firmware build. Publicly available exploit code exists (publicly available exploit code exists), but there is no confirmation of active exploitation (CISA KEV) at time of analysis, and no vendor-released patch was identified in the available data.
Stack-based buffer overflows in the formPingCmd functionality of Planet WGR-500 firmware v1.3411b190912 allow a remote attacker with low-privilege authentication (CVSS PR:L) to corrupt stack memory by sending HTTP requests that combine oversized values in the submit-url and ipaddr parameters, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). Publicly available exploit information was published by Cisco Talos (TALOS-2025-2226), and no confirmation of active exploitation (CISA KEV) was found at time of analysis. Attackers must first reach the router's web management interface and hold valid credentials or an authenticated session, so exposure is bounded to devices with the admin UI reachable from untrusted networks.
Authenticated stack-based buffer overflow in Planet WGR-500 firmware v1.3411b190912 allows remote attackers with low-privilege credentials to achieve full compromise via crafted HTTP requests to the formPingCmd functionality, specifically the submit-url parameter. The vulnerability requires network access to the device's HTTP management interface and valid authentication (CVSS PR:L), but no user interaction, and grants high confidentiality, integrity, and availability impact. Publicly available exploit code exists, increasing the risk for unpatched devices exposed to untrusted networks.
A stack-based buffer overflow in the formPingCmd handler of the Planet WGR-500 wireless router (firmware v1.3411b190912) lets an authenticated remote attacker crash or potentially execute code by submitting crafted HTTP requests with an oversized `counts` parameter. The flaw affects the web management interface, which normally sits on the LAN; exploitation requires network reachability to that interface plus valid low-privilege credentials (CVSS PR:L), so it is not unauthenticated. Publicly available exploit code exists and a Talos advisory (TALOS-2025-2226) documents the issue, but it is not in CISA KEV and EPSS is modest at 0.73% (53rd percentile) - a credible, actionable issue but not an emergency.
Stack-based buffer overflows in the formPingCmd diagnostic handler of the Planet WGR-500 wireless router (firmware v1.3411b190912) let a network-reachable, low-privilege authenticated attacker (CVSS PR:L, UI:N) corrupt the stack by sending a crafted series of HTTP requests containing an oversized ipaddr parameter, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw (CWE-121) stems from unsafe concatenation of the ipaddr value into the shell command string "ping -c <counts> <ipaddr> 2>&1 > %s &", so successful exploitation can redirect execution and potentially achieve remote code execution in the context of the router's web service. Publicly available exploit code exists (disclosed via Cisco Talos TALOS-2025-2226), though CISA KEV status is not indicated; exploitation requires the management interface to be exposed and valid credentials or default/weak credentials to reach the authenticated diagnostic function.
Authenticated memory corruption in Planet WGR-500 firmware 1.3411b190912 allows a low-privileged attacker with access to the web management interface to corrupt process memory via a crafted format string in the formPingCmd functionality. The flaw rates CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring valid low-privilege credentials and a specific series of HTTP requests rather than a single call. Publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV) at time of analysis, and the attack surface is typically limited to LAN-side management interfaces rather than internet-exposed deployments.