CVE-2025-48826
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to memory corruption.
Risk Assessment
May lead to memory corruption, potentially enabling code execution or destabilizing the network device.
Recommendation
Update the Planet WGR-500 firmware to the latest version that fixes this vulnerability, or restrict access to the HTTP interface.
Other vulnerabilities in Planet WGR-500
See all- CVE-2025-54406High
Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to arbitrary command execution. This command injection is related to the `counts` request parameter.
- CVE-2025-54405High
Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to arbitrary command execution. This command injection is related to the `ipaddr` request parameter.
- CVE-2025-54404High
Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead to arbitrary command execution. This command injection is related to the `new_device_name` request parameter.
- CVE-2025-54403High
Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead to arbitrary command execution. This command injection is related to the `new_password` request parameter.
- CVE-2025-54402High
Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. Specially crafted HTTP requests with submit-url and ipaddr parameters can trigger buffer overflows.
- CVE-2025-54401High
Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. Specially crafted HTTP requests can lead to stack-based buffer overflow. This vulnerability is related to the `submit-url` request parameter.
- CVE-2025-54400High
Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to stack-based buffer overflow. An attacker can send a series of HTTP requests to trigger these vulnerabilities.
- CVE-2025-54399High
Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. Specially crafted HTTP requests can lead to stack-based buffer overflow. This vulnerability is related to the `ipaddr` request parameter used to compose the `"ping -c <counts> <ipaddr> 2>&1 > %s &"` string.
Original NVD description (English source)
A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to memory corruption. An attacker can send a series of HTTP requests to trigger this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS