CVE-2025-46274 Planet Technology CVE debrief

Who should care

Organizations using Planet Technology UNI-NMS-Lite, NMS-500, or NMS-1000-series management software should treat this as urgent, especially teams operating industrial or OT-adjacent networks where these tools manage sensitive infrastructure.

Technical summary

The advisory describes hard-coded credentials exposed in Planet Technology management products, enabling unauthenticated database access. The supplied CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which matches a remotely exploitable issue with high impact across confidentiality, integrity, and availability. The CSAF affected product list explicitly names UNI-NMS-Lite <=1.0b211018, NMS-500 (all versions), and NMS-1000V (all versions), while the narrative description uses NMS-1000; that naming should be reconciled against vendor guidance before remediation planning.

Defensive priority

Immediate. This is a network-exploitable, unauthenticated, critical-severity issue with vendor patches reported as available. Prioritize external exposure review, patching, and verification of any management database integrity concerns.

Recommended defensive actions

• Apply the vendor patches identified in the CISA advisory for all affected Planet Technology products.
• Confirm whether any affected management interfaces are reachable from untrusted networks and restrict access to administrative segments only.
• Review managed database contents and logs for unexpected changes, especially unauthorized reads, inserts, or modifications.
• Rotate or replace any credentials associated with the affected products, including any credentials that may have been hard-coded or otherwise exposed.
• Validate the exact affected product naming and version mapping in your environment, especially the NMS-1000 versus NMS-1000V naming used in the source advisory.
• Use CISA ICS recommended practices and defense-in-depth guidance to reduce exposure around industrial or OT management systems.

Evidence notes

Source evidence comes from the CISA CSAF advisory ICSA-25-114-06 and the linked official references. The source states that UNI-NMS-Lite, NMS-500, and NMS-1000 use hard-coded credentials that could allow an unauthenticated attacker to read, manipulate, and create entries in the managed database. The CSAF affected-product section lists UNI-NMS-Lite <=1.0b211018, NMS-500 all versions, and NMS-1000V all versions. The advisory was initially published on 2025-04-24 and revised on 2025-05-06 for typo fixes. No KEV entry is indicated in the supplied data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.