Open PLC and Planet vulnerabilities

Summary: Cisco Talos disclosed one denial-of-service vulnerability in the OpenPLC_v3 logic controller's ModbusTCP server, tracked as TALOS-2025-2223 (CVE-2025-53476), which a series of crafted TCP connections can trigger to block subsequent Modbus requests. Talos also disclosed four vulnerabilities in the Planet WGR-500 industrial IoT router, including stack-based buffer overflows and a format string flaw in formPingCmd and OS command injection flaws in swctrl and formPingCmd that can lead to arbitrary command execution. The vendors have patched the vulnerabilities.
Bottom line: These flaws sit in an open-source PLC built as a low-cost industrial automation option and in a router deployed in transportation and government buildings, where command injection means an attacker who reaches the device can run arbitrary commands on it.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-48826 CVE-2025-53476 CVE-2025-54399 CVE-2025-54402 CVE-2025-54403 CVE-2025-54404 CVE-2025-54405 CVE-2025-54406
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026