CVE-2025-46271: Planet Technology Network Products OS Command Injection

Published Apr 24, 2025

Updated

UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data.

Affected Software

6 affected components

Planet Technology UNI-NMS-Lite

Planet Technology UNI-NMS-Lite: Versions 1.0b211018 and prior

Planet Technology NMS-500: All Versions

Planet Technology NMS-1000V: All Versions

Planet Technology WGS-804HPT-V2: Versions 2.305b250121 and prior

Planet Technology WGS-4215-8T2S: Versions 1.305b241115 and prior

Remediation

Information

Planet Technology has released patches for the following devices: * WGS-804HPT (v2) https://www.planet.com.tw/en/product/wgs-804hpt-v2 * WGS-4215-8T2 https://www.planet.com.tw/en/product/wgs-4215-8t2s * S https://www.planet.com.tw/en/product/wgs-4215-8t2s UNI-NMS https://www.planet.com.tw/en/product/uni-nms * NMS-500 https://www.planet.com.tw/en/product/nms-500 * NMS-1000V https://www.planet.com.tw/en/product/nms-1000v

Event History

Apr 24, 2025

CVE Published

via MITRE·10:53 PM

Data Sourced

via MITRE·10:53 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeakness

Apr 14, 57299

Event

via FIRST·08:41 AM

Parent advisories

This vulnerability appears in the following advisories.

ICSA-25-114-06

Frequently Asked Questions

What is the severity of CVE-2025-46271?

CVE-2025-46271 is classified as a critical vulnerability due to the potential for unauthorized command injection that can compromise device data.

How do I fix CVE-2025-46271?

To fix CVE-2025-46271, you should update to the latest versions of affected Planet Technology products as recommended by the vendor.

Which products are affected by CVE-2025-46271?

CVE-2025-46271 affects Planet Technology UNI-NMS-Lite versions 1.0b211018 and prior, as well as various NMS-500, NMS-1000V, WGS-804HPT-V2, and WGS-4215-8T2S versions.

Can CVE-2025-46271 be exploited remotely?

Yes, CVE-2025-46271 can be exploited by unauthenticated attackers remotely, allowing potential data manipulation.

What type of attack is associated with CVE-2025-46271?

CVE-2025-46271 is associated with a command injection attack, which can lead to unauthorized access and data compromise.