Hard-Coded Havoc: The Fatal Flaws in Planet’s Network Devices

Daily Security Review

Content provided by Daily Security Review. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Daily Security Review or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://staging.podcastplayer.com/legal.

2d ago 11:39

MP3•Episode home

A wave of critical vulnerabilities in Planet Technology’s industrial switches and network management systems could let attackers hijack devices, steal data, and sabotage industrial networks—with no credentials required.

In this urgent episode, we dissect:
🔓 The 5 worst flaws (CVSS 9.3+)—from hard-coded database passwords to pre-auth command injection—discovered by Immersive Labs’ Kev Breen.
🏭 Why factories and critical infrastructure are prime targets: These switches are widely used in manufacturing, energy, and OT environments.
💻 How hackers exploit them:

MongoDB exposed? Default creds (planet:123456) let attackers dump configs.
Bypass auth entirely with a malformed URL parameter (/dispatcher.cgi?cmd=532&ip_URL=;).
Intercept device communications due to hard-coded keys.
🛡️ CISA’s emergency advisory (ICSA-25-114-06)—and why patching WGS, NMS, and UNI-NMS devices is non-negotiable.
🔍 The researcher’s journey: How a home lab, firmware analysis, and a lucky accident uncovered these flaws.

If your network relies on Planet Technology switches, this episode is a wake-up call. Tune in before attackers beat you to the patch.

51 episodes

#Tech #News #Tech News #Daily Security Review