PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-46271 Planet Technology CVE debrief

CVE-2025-46271 is a critical, network-reachable command-injection vulnerability affecting Planet Technology network management products. According to CISA’s CSAF advisory, an unauthenticated attacker could read or manipulate device data on affected systems. Vendor patches are available, and the advisory was initially published on 2025-04-24 and later revised on 2025-05-06 for typo fixes only.

Vendor
Planet Technology
Product
UNI-NMS-Lite
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2025-04-24
Original CVE updated
2025-05-06
Advisory published
2025-04-24
Advisory updated
2025-05-06

Who should care

Organizations running Planet Technology UNI-NMS-Lite, NMS-500, or NMS-1000V should treat this as urgent, especially teams responsible for OT/ICS network management, appliance administration, and perimeter exposure reviews. Security teams should also care because the issue is unauthenticated and has a critical CVSS 9.1 score.

Technical summary

CISA’s advisory describes a command-injection issue in Planet Technology UNI-NMS-Lite, NMS-500, and NMS-1000V. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating a remotely reachable flaw requiring no privileges or user interaction, with high confidentiality and integrity impact. The advisory’s narrative text mentions NMS-1000, while the affected-products list specifically names NMS-1000V; the affected-products list is the authoritative product listing in the supplied CSAF.

Defensive priority

Highest priority. The combination of unauthenticated network access and critical impact warrants immediate patching, exposure review, and compensating controls until remediation is complete.

Recommended defensive actions

  • Apply the vendor patches listed in the CISA advisory for UNI-NMS-Lite, NMS-500, and NMS-1000V as soon as feasible.
  • Inventory Planet Technology deployments and confirm whether any affected versions are present, including UNI-NMS-Lite <=1.0b211018 and NMS-500/NMS-1000V installations.
  • Restrict network access to management interfaces and limit exposure to trusted administrative networks only.
  • Review logs and device configuration for unexpected changes or command execution activity around the advisory date and after.
  • Follow CISA ICS recommended practices and general defense-in-depth guidance while remediation is underway.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-25-114-06 (published 2025-04-24, revised 2025-05-06). The CSAF lists affected products as Planet Technology UNI-NMS-Lite <=1.0b211018, NMS-500 vers:all/*, and NMS-1000V vers:all/*. The advisory description states that UNI-NMS-Lite, NMS-500, and NMS-1000 are vulnerable to command injection that could allow an unauthenticated attacker to read or manipulate device data. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, matching the critical severity score of 9.1. No KEV entry is indicated in the supplied data.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-46271 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-46271

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-46271 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-46271

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-114-06.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-06

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.