CVE-2025-54400

Sentinel/Defender KQL

let MaxParamLength = 250;
DeviceNetworkEvents
| where RemoteUrl contains "formPingCmd"
| where (UrlQuery has "counts=" and strlen(tostring(extract(@"counts=([^&]+)", 1, UrlQuery))) > MaxParamLength)
   or (UrlQuery has "ipaddr=" and strlen(tostring(extract(@"ipaddr=([^&]+)", 1, UrlQuery))) > MaxParamLength)
   or (UrlQuery has "submit-url=" and strlen(tostring(extract(@"submit-url=([^&]+)", 1, UrlQuery))) > MaxParamLength)

Splunk SPL

sourcetype=access_combined uri_path="*formPingCmd*" 
| rex field=uri_query "counts=(?<counts_param>[^&]+)" 
| rex field=uri_query "ipaddr=(?<ipaddr_param>[^&]+)" 
| rex field=uri_query "submit-url=(?<submit_url_param>[^&]+)" 
| eval counts_len=len(counts_param) 
| eval ipaddr_len=len(ipaddr_param) 
| eval submit_url_len=len(submit_url_param) 
| where counts_len > 250 OR ipaddr_len > 250 OR submit_url_len > 250

Sigma

title: Planet WGR-500 formPingCmd Buffer Overflow Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects attempts to exploit stack-based buffer overflow vulnerabilities in Planet WGR-500 formPingCmd functionality by sending oversized parameters.
references:
  - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2226
author: SecBoard
date: 2025/10/07
logsource:
  category: webserver
  product: generic
detection:
  selection:
    uri|contains: 'formPingCmd'
    uri|re: 'counts=[^&]{251,}|ipaddr=[^&]{251,}|submit-url=[^&]{251,}'
  condition: selection
fields:
  - http.request.uri
  - http.request.method
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2025.54400
  - exploitation
level: high

Elastic ES|QL

from http_logs
| where url.path : "*formPingCmd*"
| where 
    (url.query : "counts=*" and length(url.query.counts) > 250) or
    (url.query : "ipaddr=*" and length(url.query.ipaddr) > 250) or
    (url.query : "submit-url=*" and length(url.query.submit_url) > 250)