CVE-2025-46272CWE-78

Planet Technology Network Products OS Command Injection

Critical · published April 24, 2025

CVSS v4.0
9.3
EPSS
1%
Percentile
69.0
In the wild
Unconfirmed
What it is

🚨 A crafty command injection vulnerability lurks in WGS-80HPT-V2 and WGS-4215-8T2S, allowing any unauthenticated attacker to execute OS commands! 🔥 Think of this like a faulty intercom system in a secure building — anyone outside could buzz in and issue commands to open doors or access restricted areas without verification. This vulnerability could let attackers gain the upper hand in your system. With this vulnerability, an attacker can execute arbitrary OS commands, which could lead to unauthorized access, data breaches, or even taking control of the entire system. This could be absolutely devastating for your operations!

Put simply

Think of this like a faulty intercom system in a secure building — anyone outside could buzz in and issue commands to open doors or access restricted areas without verification. This vulnerability could let attackers gain the upper hand in your system. The command injection flaw in WGS-80HPT-V2 and WGS-4215-8T2S allows unauthenticated users to run OS commands on the host system due to improper input validation.

What to do

With this vulnerability, an attacker can execute arbitrary OS commands, which could lead to unauthorized access, data breaches, or even taking control of the entire system. This could be absolutely devastating for your operations! Immediate action is crucial! Update to the latest firmware version provided by the vendor and ensure that input validation mechanisms are in place to prevent command injection. Regularly audit your systems to catch similar vulnerabilities early! You've got this! Follow these steps, and you'll fortify your defenses in no time. 🛡️

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.01241 · 69.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-04-24T22:56Z
EPSS history
Timeline
  • 24 APR 22:56Z
    Planet Technology Network Products OS Command Injection
    cvelistv5