SecBoard
Zurück zur CVE-Übersicht

CVE-2025-54403

HIGH(8.8)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score23/100 — NIEDRIG
  • CVSS 8.8 — Hoch

EPSS-Score

4.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.8

Technische Schwere

Beschreibung

Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is related to the `new_password` request parameter.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detection for OS command injection in Planet WGR-500 swctrl functionality via UDP. Focus on unusual process creation or network activity originating from the device.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "swctrl" or FileName =~ "sh" or FileName =~ "bash" or FileName =~ "cmd.exe"
| where ProcessCommandLine contains "new_password" or ProcessCommandLine matches regex ".*(&|\||;|<|>|`|\\).*"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, RemoteIP, RemotePort

Splunk SPL

(sourcetype=sysmon OR sourcetype=linux_audit OR sourcetype=windows_security)
(process="swctrl" OR process="sh" OR process="bash" OR process="cmd.exe")
(command_line=*new_password* OR command_line=~"*(&|\||;|<|>|`|\\)*")
| table _time, host, process, command_line, dest_ip, dest_port

Sigma

title: Planet WGR-500 swctrl OS Command Injection
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects OS command injection attempts in Planet WGR-500 swctrl functionality.
references:
  - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2227
author: SecBoard
date: 2025/10/07
logsource:
  category: process_creation
  product: linux
tags:
  - attack.execution
  - attack.t1059
detection:
  selection:
    ParentImage|endswith:
      - '\swctrl'
    Image|endswith:
      - '\sh'
      - '\bash'
      - '\cmd.exe'
  condition: selection

Elastic ES|QL

from process where
  (process.parent.executable : "swctrl" or process.executable : ("sh", "bash", "cmd.exe")) and
  (process.args : "*new_password*" or process.args : "*&*" or process.args : "*|*" or process.args : "*;*" or process.args : "*<*" or process.args : "*>*" or process.args : "*`*" or process.args : "*\\*")
| select @timestamp, host.name, process.parent.executable, process.executable, process.args, destination.ip, destination.port

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (1)

  • www.planet.com.tw

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Betroffene Produkte

  • cpe:2.3:o:planet:wgr-500_firmware:1.3411b190912:*:*:*:*:*:*:*

Referenzen