Critical Vulnerabilities Discovered in Planet Technology Industrial Cellular Gateways

According to the Taiwan Computer Emergency Response Team / Coordination Center (TWCERT/CC) advisory, two critical vulnerabilities in Planet Technology’s Industrial Cellular Gateways have been disclosed, tracked as CVE-2025-9971 and CVE-2025-9972, each scoring 9.8 on the CVSS scale and exposing devices to unauthenticated remote exploitation and potential complete takeover.

The flaws allow unauthenticated remote attackers to manipulate the device via a specific functionality (CVE-2025-9971) and to inject arbitrary OS commands and execute them on the device (CVE-2025-9972). Affected models include ICG-2510WG-LTE (EU/US) version 1.0-20240918 and earlier, and ICG-2510W-LTE (EU/US) version 1.0_20240411 and earlier, which are commonly deployed in critical infrastructure, smart city deployments and industrial IoT environments.

Mitigation guidance notes that the lack of authentication enables remote manipulation of settings or disruption without valid credentials, while the OS command injection flaw could lead to full device compromise, network disruption and use of the gateway as a pivot for further attacks within industrial networks. Users are urged to apply patches by updating ICG-2510WG-LTE to version 1.0_20250811 or later and ICG-2510W-LTE to version 1.0_20250811 or later.