SecBoard
Zurück zur CVE-Übersicht

CVE-2025-54402

HIGH(8.8)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score22/100 — NIEDRIG
  • CVSS 8.8 — Hoch

EPSS-Score

0.8%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.8

Technische Schwere

Beschreibung

Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to stack-based buffer overflow. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This buffer overflow is related to the `submit-url` and `ipaddr` request parameters combined.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detects HTTP requests to the formPingCmd functionality with unusually long 'submit-url' or 'ipaddr' parameters, indicative of buffer overflow attempts.

Sentinel/Defender KQL

let long_submit_url_threshold = 260;
let long_ipaddr_threshold = 32;
HttpRequests
| where Url contains "formPingCmd"
| where (Url contains "submit-url=" and strlen(extract(@"submit-url=([^&]+)", 1, Url)) > long_submit_url_threshold)
   or (Url contains "ipaddr=" and strlen(extract(@"ipaddr=([^&]+)", 1, Url)) > long_ipaddr_threshold)
| project TimeGenerated, SourceIp, DestinationIp, Url, UserAgent

Splunk SPL

index=* sourcetype=access_combined uri_path=*formPingCmd*
| eval submit_url_len = len(urldecode(mvindex(split(mvindex(split(uri, "submit-url=", 1), 0), "&", 0), 0)))
| eval ipaddr_len = len(urldecode(mvindex(split(mvindex(split(uri, "ipaddr=", 1), 0), "&", 0), 0)))
| where (submit_url_len > 260) OR (ipaddr_len > 32)
| table _time, clientip, uri, submit_url_len, ipaddr_len

Sigma

title: Planet WGR-500 formPingCmd Buffer Overflow Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects attempts to exploit stack-based buffer overflow vulnerabilities in Planet WGR-500 formPingCmd functionality via long 'submit-url' or 'ipaddr' parameters.
references:
  - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2226
logsource:
  category: webserver
  service: access_log
detection:
  selection:
    cs-uri-stem|contains: 'formPingCmd'
  condition: selection and (long_submit_url or long_ipaddr)
  long_submit_url:
    cs-uri-query|contains: 'submit-url='
    cs-uri-query|length_gt: 260 # Approximate length check for submit-url
  long_ipaddr:
    cs-uri-query|contains: 'ipaddr='
    cs-uri-query|length_gt: 32 # Approximate length check for ipaddr
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
level: high

Elastic ES|QL

from http_logs
| where url.path : "*formPingCmd*"
| eval submit_url = query_string("submit-url"), ipaddr = query_string("ipaddr")
| where length(submit_url) > 260 or length(ipaddr) > 32
| select timestamp, source.ip, destination.ip, url.full, user_agent.original

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (1)

  • www.planet.com.tw

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Betroffene Produkte

  • cpe:2.3:o:planet:wgr-500_firmware:1.3411b190912:*:*:*:*:*:*:*

Referenzen