CVE-2025-46274: Planet Technology Network Products Use of Hard-coded Credentials

Published Apr 24, 2025

Updated

UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database.

Affected Software

5 affected components

Planet Technology UNI-NMS-Lite: Versions 1.0b211018 and prior

Planet Technology NMS-500: All Versions

Planet Technology NMS-1000V: All Versions

Planet Technology WGS-804HPT-V2: Versions 2.305b250121 and prior

Planet Technology WGS-4215-8T2S: Versions 1.305b241115 and prior

Remediation

Information

Planet Technology has released patches for the following devices: * WGS-804HPT (v2) https://www.planet.com.tw/en/product/wgs-804hpt-v2 * WGS-4215-8T2 https://www.planet.com.tw/en/product/wgs-4215-8t2s * S https://www.planet.com.tw/en/product/wgs-4215-8t2s UNI-NMS https://www.planet.com.tw/en/product/uni-nms * NMS-500 https://www.planet.com.tw/en/product/nms-500 * NMS-1000V https://www.planet.com.tw/en/product/nms-1000v

Event History

Apr 24, 2025

CVE Published

via MITRE·10:57 PM

Data Sourced

via MITRE·10:57 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeakness

Apr 14, 57299

Event

via FIRST·08:42 AM

Parent advisories

This vulnerability appears in the following advisories.

ICSA-25-114-06

Frequently Asked Questions

What is the severity of CVE-2025-46274?

CVE-2025-46274 is considered a critical vulnerability due to its exploitation potential by an unauthenticated attacker.

How do I fix CVE-2025-46274?

To fix CVE-2025-46274, users should update to the latest version of UNI-NMS-Lite or affected devices that have addressed the hard-coded credentials.

What products are affected by CVE-2025-46274?

CVE-2025-46274 affects Planet Technology's UNI-NMS-Lite, NMS-500, NMS-1000V, WGS-804HPT-V2, and WGS-4215-8T2S products.

What kind of access does CVE-2025-46274 allow an attacker?

CVE-2025-46274 allows an unauthenticated attacker to read, manipulate, and create entries in the managed database.

Is authentication required to exploit CVE-2025-46274?

No, CVE-2025-46274 does not require authentication, making it easier for attackers to exploit the vulnerability.