A high-severity OS command injection vulnerability in the Planet WGR-500 router allows authenticated attackers to achieve remote code execution on the device.

This vulnerability involves an OS command injection flaw within the formPingCmd function, specifically triggered through the ipaddr request parameter. The CVSS vector (PR:L) confirms that an attacker must possess low-level authenticated access to the device to successfully execute arbitrary commands.

Successful exploitation of this vulnerability permits an attacker to execute arbitrary OS commands with the privileges of the web server. This could lead to a total compromise of the device, enabling the attacker to pivot into the internal network, intercept traffic, or cause permanent denial of service. With a CVSS score of 8.8, the risk to operational continuity and network integrity is significant.

Immediate Action: Contact the vendor or consult the official support portal to determine if a firmware update is available for this specific model, as no patch status is currently confirmed.

Proactive Monitoring: Implement network segmentation to isolate the management interface and review administrative access logs for suspicious activity involving the formPingCmd endpoint.

Compensating Controls: Restrict access to the router management interface to trusted IP addresses only, and deploy a WAF or intrusion detection system to monitor for malicious command injection patterns in HTTP requests.

Public Exploit Available: Unknown

Given the severity of potential remote code execution, administrators should prioritize restricting network access to the affected device. Until a vendor-supplied patch is confirmed and deployed, verify that all default credentials have been changed and monitor the device for unauthorized configuration changes or anomalous traffic patterns.