CVE-2025-46272: Planet Technology Network Products OS Command Injection

Published Apr 24, 2025

Updated

WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host system.

Affected Software

5 affected components

Planet Technology UNI-NMS-Lite: Versions 1.0b211018 and prior

Planet Technology NMS-500: All Versions

Planet Technology NMS-1000V: All Versions

Planet Technology WGS-804HPT-V2: Versions 2.305b250121 and prior

Planet Technology WGS-4215-8T2S: Versions 1.305b241115 and prior

Remediation

Information

Planet Technology has released patches for the following devices: * WGS-804HPT (v2) https://www.planet.com.tw/en/product/wgs-804hpt-v2 * WGS-4215-8T2 https://www.planet.com.tw/en/product/wgs-4215-8t2s * S https://www.planet.com.tw/en/product/wgs-4215-8t2s UNI-NMS https://www.planet.com.tw/en/product/uni-nms * NMS-500 https://www.planet.com.tw/en/product/nms-500 * NMS-1000V https://www.planet.com.tw/en/product/nms-1000v

Event History

Apr 24, 2025

CVE Published

via MITRE·10:56 PM

Data Sourced

via MITRE·10:56 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeakness

Apr 14, 57299

Event

via FIRST·08:42 AM

Parent advisories

This vulnerability appears in the following advisories.

ICSA-25-114-06

Frequently Asked Questions

What is the severity of CVE-2025-46272?

CVE-2025-46272 is classified as a critical vulnerability due to the potential for unauthenticated attackers to execute OS commands.

How do I fix CVE-2025-46272?

To fix CVE-2025-46272, update the affected Planet Technology products to their latest secure versions as specified in the vendor advisories.

Which products are affected by CVE-2025-46272?

CVE-2025-46272 affects the Planet Technology UNI-NMS-Lite versions 1.0b211018 and prior, NMS-500, NMS-1000V, WGS-804HPT-V2 versions 2.305b250121 and prior, and WGS-4215-8T2S versions 1.305b241115 and prior.

Can CVE-2025-46272 be exploited remotely?

Yes, CVE-2025-46272 can be exploited remotely by attackers without authentication.

What type of attack is associated with CVE-2025-46272?

CVE-2025-46272 is associated with a command injection attack, allowing execution of arbitrary OS commands.