CVE-2025-46273 Planet Technology CVE debrief

Who should care

Organizations using Planet Technology UNI-NMS-Lite, NMS-500, NMS-1000V, WGS-804HPT-V2, or WGS-4215-8T2S should treat this as urgent, especially if any affected device is reachable from untrusted networks or used to manage broader device fleets.

Technical summary

According to the CISA CSAF advisory, affected Planet Technology products contain hard-coded credentials. That design flaw can let an unauthenticated network attacker obtain administrative privileges. The reported impact is especially serious because compromise of UNI-NMS-managed infrastructure can extend beyond a single appliance and affect managed devices as well. The provided CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, matching a 9.8 critical score.

Defensive priority

Highest. This is an unauthenticated, network-reachable credential flaw with full confidentiality, integrity, and availability impact in the advisory’s scoring. Prioritize patching and exposure reduction immediately.

Recommended defensive actions

• Apply the vendor patches referenced in the advisory for all affected Planet Technology products.
• Inventory deployments of UNI-NMS-Lite, NMS-500, NMS-1000V, WGS-804HPT-V2, and WGS-4215-8T2S to confirm affected versions are identified.
• If any affected device is exposed to untrusted networks, restrict access until patched by limiting management-plane reachability and using trusted administrative paths only.
• Review administrative access logs and configuration changes for signs of unauthorized access to management interfaces.
• Validate that no stale or default administrative access paths remain in place after remediation.
• Follow CISA industrial control system recommended practices for defense in depth and ongoing monitoring.

Evidence notes

All substantive claims are taken from the supplied CISA CSAF advisory corpus and its listed official references. The advisory explicitly states that affected products use hard-coded credentials and that this could allow an unauthenticated attacker to gain administrative privileges to UNI-NMS managed devices. The revision history notes a second publication on 2025-05-06 with typo fixes only. No KEV listing was provided.

Official resources