A critical OS command injection vulnerability in Planet WGR-500 routers permits authenticated attackers to execute arbitrary system commands, risking total device compromise.

This vulnerability is an improper neutralization of special elements used in an OS command (CWE-78). By sending a specially crafted series of HTTP requests targeting the counts parameter within the formPingCmd function, a logged-in user can achieve remote code execution on the underlying operating system.

The ability to execute arbitrary OS commands on a network router poses a severe threat to internal infrastructure. A successful exploit grants an attacker full control over the gateway, potentially enabling lateral movement, traffic interception, and persistent unauthorized access to the local network. With a CVSS score of 8.8, this vulnerability represents a high-severity risk to confidentiality, integrity, and availability.

Immediate Action: Contact the vendor or monitor official support channels for a firmware update that addresses the formPingCmd command injection flaw. If no patch is available, isolate the management interface from the network.

Proactive Monitoring: Review web server access logs for anomalous HTTP requests containing shell metacharacters or unexpected parameters directed at the formPingCmd endpoint.

Compensating Controls: Implement strict network access control lists to limit access to the router management interface to trusted administrative IP addresses only, reducing the attack surface for this authenticated requirement.

Public Exploit Available: Unknown.

Given the high CVSS score and the direct impact on network infrastructure, this vulnerability should be treated as a priority. Administrators must restrict management access to the affected Planet WGR-500 devices immediately and monitor for vendor-released firmware updates to permanently remediate the underlying code vulnerability.