CVE-2025-46275: WGS Switch Auth Bypass Vulnerability

CVE-2025-46275 Overview

CVE-2025-46275 is a critical authentication bypass vulnerability affecting Planet Technology WGS-80HPT-V2 and WGS-4215-8T2S industrial managed switches. The devices are missing authentication controls that could allow an unauthenticated attacker to create an administrator account without knowing any existing credentials. This vulnerability represents a complete breakdown of access control, enabling full device takeover through the network.

Critical Impact

An unauthenticated remote attacker can create administrator accounts on affected industrial switches, gaining complete control over network infrastructure without requiring any prior authentication or credentials.

Affected Products

• Planet Technology WGS-80HPT-V2 Industrial Managed Switch
• Planet Technology WGS-4215-8T2S Industrial Managed Switch

Discovery Timeline

• April 24, 2025 - CVE-2025-46275 published to NVD
• April 29, 2025 - Last updated in NVD database

Technical Details for CVE-2025-46275

Vulnerability Analysis

This vulnerability falls under CWE-306 (Missing Authentication for Critical Function), one of the most severe authentication-related weaknesses. The affected Planet Technology industrial switches fail to implement proper authentication checks on critical administrative functions. Specifically, the account creation functionality can be accessed without any authentication mechanism in place, allowing remote attackers to create new administrator accounts.

Industrial network switches like the WGS-80HPT-V2 and WGS-4215-8T2S are typically deployed in operational technology (OT) environments, industrial control systems (ICS), and critical infrastructure networks. The lack of authentication on administrative functions in such devices poses significant risks to industrial operations and safety systems.

Root Cause

The root cause of CVE-2025-46275 is the complete absence of authentication verification on the administrator account creation endpoint. The device's management interface fails to validate that requests to create administrative accounts originate from authenticated and authorized users. This design flaw allows any network-accessible attacker to invoke privileged account management functions directly.

Attack Vector

The attack vector is network-based and requires no prior authentication, privileges, or user interaction. An attacker with network access to the vulnerable switch's management interface can directly invoke the account creation functionality. The attack sequence involves:

1. An attacker identifies a vulnerable Planet Technology WGS-80HPT-V2 or WGS-4215-8T2S switch accessible on the network
2. The attacker sends a crafted request to the administrative account creation endpoint
3. Without any authentication check, the device processes the request and creates a new administrator account with attacker-controlled credentials
4. The attacker logs in with the newly created administrator account to gain full device control

Once an attacker has administrative access, they can modify switch configurations, intercept or redirect network traffic, disable security features, create persistence mechanisms, or use the compromised device as a pivot point for lateral movement within industrial networks.

Detection Methods for CVE-2025-46275

Indicators of Compromise

• Unexpected administrator accounts appearing in the device user database
• Authentication logs showing new user creation events without corresponding authorized administrative sessions
• Network traffic to management interfaces from unauthorized IP addresses or network segments
• Configuration changes or device reboots not associated with scheduled maintenance

Detection Strategies

• Monitor management interface access logs for account creation events, particularly those not preceded by successful authentication
• Implement network-level monitoring for connections to switch management ports (typically HTTP/HTTPS and SSH)
• Deploy industrial intrusion detection systems (IDS) to identify anomalous administrative traffic patterns
• Conduct regular audits of administrator accounts on all managed switches to identify unauthorized additions

Monitoring Recommendations

• Enable comprehensive logging on all management interface activities and forward logs to a centralized SIEM
• Implement network segmentation to isolate switch management interfaces from general network traffic
• Configure alerting for any account creation or privilege modification events on industrial network equipment
• Review CISA ICS Advisory for additional detection guidance specific to this vulnerability

How to Mitigate CVE-2025-46275

Immediate Actions Required

• Restrict network access to the management interfaces of affected devices using firewalls or access control lists (ACLs)
• Isolate affected switches on dedicated management VLANs that are not accessible from untrusted networks
• Audit existing administrator accounts on WGS-80HPT-V2 and WGS-4215-8T2S devices and remove any unauthorized accounts
• Monitor the CISA ICS Advisory ICSA-25-114-06 for vendor patch availability and remediation guidance

Patch Information

Organizations should monitor Planet Technology's security advisories and the CISA ICS Advisory ICSA-25-114-06 for official firmware updates that address this authentication bypass vulnerability. Apply vendor-provided patches as soon as they become available after appropriate testing in non-production environments.

Workarounds

• Implement strict network segmentation to limit management interface access to authorized administrative workstations only
• Deploy a jump host or bastion server for all administrative access to industrial network equipment
• Enable VPN access requirements for remote management of affected switches
• Disable unused management protocols and services on affected devices to reduce attack surface

# Example network ACL configuration to restrict management access
# Apply firewall rules to limit access to switch management interface
# Only allow connections from authorized management network (e.g., 10.10.10.0/24)
iptables -A INPUT -s 10.10.10.0/24 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -s 10.10.10.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP