Cyber Posture

CVE-2025-54404

HighPublic PoC

Published: 07 October 2025

Published
07 October 2025
Modified
03 November 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0041 61.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Security Summary

CVE-2025-54404 involves multiple OS command injection vulnerabilities (CWE-78) in the swctrl functionality of Planet WGR-500 version v1.3411b190912. Published on 2025-10-07, the flaws are triggered by a specially crafted network request targeting the `new_device_name` request parameter, enabling arbitrary command execution. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An attacker with low privileges can exploit these issues remotely over the network with low attack complexity and no user interaction. By sending a malicious network request, the attacker gains the ability to execute arbitrary OS commands on the device, resulting in high impacts to confidentiality, integrity, and availability.

Mitigation guidance and additional details are available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2227.

Details

CWE(s)
CWE-78

Affected Products

planet
wgr-500 firmware
1.3411b190912

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

OS command injection via crafted network request to web parameter enables exploitation of public-facing application (T1190), arbitrary OS command execution on network device (T1059.008), and privilege escalation from low privileges to high-impact RCE (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References