SecBoard
Zurück zur CVE-Übersicht

CVE-2025-54401

HIGH(8.8)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score22/100 — NIEDRIG
  • CVSS 8.8 — Hoch

EPSS-Score

0.7%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.8

Technische Schwere

Beschreibung

Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to stack-based buffer overflow. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This buffer overflow is related to the `submit-url` request parameter.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detects HTTP requests to the formPingCmd functionality with unusually long 'submit-url' or 'ipaddr' parameters, indicative of buffer overflow attempts.

Sentinel/Defender KQL

let long_param_threshold = 250; // Adjust based on expected legitimate lengths
DeviceNetworkEvents
| where RemoteUrl contains "/formPingCmd"
| where RemoteUrl contains "submit-url=" or RemoteUrl contains "ipaddr="
| extend submit_url_length = strlen(extract(@"submit-url=([^&]+)", 1, RemoteUrl))
| extend ipaddr_length = strlen(extract(@"ipaddr=([^&]+)", 1, RemoteUrl))
| where submit_url_length > long_param_threshold or ipaddr_length > long_param_threshold
| project Timestamp, DeviceName, RemoteUrl, submit_url_length, ipaddr_length, InitiatingProcessCommandLine

Splunk SPL

index=web (uri_path="/formPingCmd" AND (uri=*submit-url=* OR uri=*ipaddr=*))
| eval submit_url_len = len(urldecode(mvindex(split(uri, "submit-url="), 1)))
| eval ipaddr_len = len(urldecode(mvindex(split(uri, "ipaddr="), 1)))
| where submit_url_len > 250 OR ipaddr_len > 250
| table _time, host, uri, submit_url_len, ipaddr_len

Sigma

title: Planet WGR-500 formPingCmd Buffer Overflow Attempt
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a real UUID
status: experimental
description: Detects attempts to exploit stack-based buffer overflows in Planet WGR-500 formPingCmd functionality via long HTTP parameters.
author: SecBoard
date: 2025/10/07
logsource:
  category: webserver
  product: generic
detection:
  selection:
    c-uri|contains: '/formPingCmd'
    c-uri|contains|all:
      - 'submit-url='
      - 'ipaddr='
  filter_long_submit_url:
    c-uri|length|gt: 250 # Adjust threshold as needed
  filter_long_ipaddr:
    c-uri|length|gt: 250 # Adjust threshold as needed
  condition: selection and (filter_long_submit_url or filter_long_ipaddr)
fields:
  - c-ip
  - c-uri
  - cs-method
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2025.54401
  - product.planet_wgr-500
level: high

Elastic ES|QL

from http_logs
| where url.path : "/formPingCmd"
| where url.query : "submit-url=*" or url.query : "ipaddr=*"
| eval submit_url_param = query_string("submit-url", url.query)
| eval ipaddr_param = query_string("ipaddr", url.query)
| eval submit_url_len = length(submit_url_param)
| eval ipaddr_len = length(ipaddr_param)
| where submit_url_len > 250 or ipaddr_len > 250
| select @timestamp, source.ip, url.original, submit_url_len, ipaddr_len

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (1)

  • www.planet.com.tw

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Betroffene Produkte

  • cpe:2.3:o:planet:wgr-500_firmware:1.3411b190912:*:*:*:*:*:*:*

Referenzen