CVE Intelligence

Planet vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Planet products: 10 record(s), with severity, exploitation and fixes.

Wgr-500 Firmware 9WGR-500 9ICG-2510 1

Exploited only (KEV) →

CVE-2026-3697 Medium · 6.3 CWE-119 Mar 7, 2026
Planet ICG-2510 Language Package Configuration httpd sub_40C8E4 stack-based overflow
A vulnerability was determined in Planet ICG-2510 1.0_20250811. The impacted element is the function sub_40C8E4 of the file /usr/sbin/httpd of the component Language Package Configuration Handler. Executing a manipulation of the argument Language can lead to stack-based buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-54406 High · 8.8 CWE-78 Oct 7, 2025
OS Command Injection in Planet Wgr-500 Firmware
Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `counts` request parameter.
CVE-2025-54405 High · 8.8 CWE-78 Oct 7, 2025
OS Command Injection in Planet Wgr-500 Firmware
Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `ipaddr` request parameter.
CVE-2025-54404 High · 8.8 CWE-78 Oct 7, 2025
OS Command Injection in Planet Wgr-500 Firmware
Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is related to the `new_device_name` request parameter.
CVE-2025-54403 High · 8.8 CWE-78 Oct 7, 2025
OS Command Injection in Planet Wgr-500 Firmware
Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is related to the `new_password` request parameter.
CVE-2025-54402 High · 8.8 CWE-121 Oct 7, 2025
Stack-based Buffer Overflow in Planet Wgr-500 Firmware
Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to stack-based buffer overflow. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This buffer overflow is related to the `submit-url` and `ipaddr` request parameters combined.
CVE-2025-54401 High · 8.8 CWE-121 Oct 7, 2025
Stack-based Buffer Overflow in Planet Wgr-500 Firmware
Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to stack-based buffer overflow. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This buffer overflow is related to the `submit-url` request parameter.
CVE-2025-54400 High · 8.8 CWE-121 Oct 7, 2025
Stack-based Buffer Overflow in Planet Wgr-500 Firmware
Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to stack-based buffer overflow. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This buffer overflow is related to the `counts` request parameter for composing the `"ping -c <counts> <ipaddr> 2>&1 > %s &"` string.
CVE-2025-54399 High · 8.8 CWE-121 Oct 7, 2025
Stack-based Buffer Overflow in Planet Wgr-500 Firmware
Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to stack-based buffer overflow. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This buffer overflow is related to the `ipaddr` request parameter for composing the `"ping -c <counts> <ipaddr> 2>&1 > %s &"` string.
CVE-2025-48826 High · 8.8 CWE-134 Oct 7, 2025
Use of Externally-Controlled Format String in Planet Wgr-500 Firmware
A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to memory corruption. An attacker can send a series of HTTP requests to trigger this vulnerability.