CVE-2025-9971: Planet Technology｜Industrial Cellular Gateway - Missing Authentication

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-17 · updated 2026-06-17
Weakness: CWE-306

Description

Certain models of Industrial Cellular Gateway developed by Planet Technology have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to manipulate the device via a specific functionality.

Affected products

Planet Technology ICG-2510W-LTE (EU/US): through 1.0_20240411
Planet Technology ICG-2510WG-LTE (EU/US): through 1.0-20240918

References

https://www.planet.com.tw/en/support/security-advisory/8
https://www.twcert.org.tw/en/cp-139-10390-7ce12-2.html
https://www.twcert.org.tw/tw/cp-132-10389-265a3-1.html

Get alerted when CVE-2025-9971 or the next vulnerability affects your stack