by Kastro
Paper/Archive/CVE-2025-9972

CVE-2025-9972

Planet Technology ICG-2510WG-LTE (EU/US) — Planet Technology｜Industrial Cellular Gateway - OS Command Injection

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 82.4.824 × 2016.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Certain models of Industrial Cellular Gateway developed by Planet Technology have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the device.

Affected

ProductAffectedFixed inSource
ICG-2510WG-LTE (EU/US)≤ 1.0-20240918–CNA
ICG-2510W-LTE (EU/US)≤ 1.0_20240411–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10389-265a3-1.htmlwriteuptwcert.org.tw/en/cp-139-10390-7ce12-2.htmlwriteupplanet.com.tw/en/support/security-advisory/8