Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `ipaddr` request parameter.
References
| Link | Resource |
|---|---|
| https://talosintelligence.com/vulnerability_reports/TALOS-2025-2229 | Exploit Third Party Advisory |
| https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2229 |
Configurations
Configuration 1 (hide)
| AND |
|
History
03 Nov 2025, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Oct 2025, 16:31
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:planet:wgr-500:-:*:*:*:*:*:*:* cpe:2.3:o:planet:wgr-500_firmware:1.3411b190912:*:*:*:*:*:*:* |
|
| First Time |
Planet wgr-500 Firmware
Planet Planet wgr-500 |
|
| References | () https://talosintelligence.com/vulnerability_reports/TALOS-2025-2229 - Exploit, Third Party Advisory |
07 Oct 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-07 14:15
Updated : 2025-11-03 18:16
NVD link : CVE-2025-54405
Mitre link : CVE-2025-54405
CVE.ORG link : CVE-2025-54405
JSON object : View
Products Affected
planet
- wgr-500
- wgr-500_firmware
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')