CVE-2025-54404
📋 TL;DR
This CVE describes OS command injection vulnerabilities in Planet WGR-500 routers that allow remote attackers to execute arbitrary commands via specially crafted network requests. Attackers can exploit the 'new_device_name' parameter to gain unauthorized command execution. Organizations using affected Planet WGR-500 routers are at risk.
💻 Affected Systems
- Planet WGR-500
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing persistent backdoor installation, network traffic interception, lateral movement to connected devices, and router bricking.
Likely Case
Router takeover leading to network disruption, credential harvesting, and use as pivot point for attacks on internal networks.
If Mitigated
Limited impact if network segmentation isolates the router and strict firewall rules prevent external access to vulnerable interfaces.
🎯 Exploit Status
The vulnerability is in a network-accessible function and requires only crafted HTTP requests. No authentication appears to be required based on the description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available at time of analysis
Restart Required: Yes
Instructions:
1. Check Planet vendor website for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Network Isolation
allIsolate the router from untrusted networks and restrict access to management interfaces
Firewall Rules
linuxImplement strict firewall rules to block external access to router management interfaces
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Segment the router on isolated VLAN with strict access controls
- Implement network monitoring for unusual traffic patterns to/from the router
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface. If version is v1.3411b190912, the device is vulnerable.Check Version:
Check via web interface at http://router-ip/status or via SSH if availableVerify Fix Applied:
After firmware update, verify the version no longer matches v1.3411b190912 and test that the swctrl functionality properly validates input.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to swctrl endpoints
- Commands containing shell metacharacters in new_device_name parameter
- Unexpected process execution in router logs
Network Indicators:
- HTTP requests with shell commands in parameters
- Unusual outbound connections from router
- Traffic patterns suggesting command execution
SIEM Query:
source="router_logs" AND (uri="*swctrl*" AND param="*new_device_name*" AND value="*;*" OR value="*|*" OR value="*`*" OR value="*$(*")