CISA Warns of Critical Vulnerabilities in Planet Technology Products: Warning for Houston Manufacturers

Step 1 is inventory, because a device nobody remembers is exactly the device that stays unpatched.

Step 1 is to find every Planet Technology switch and every UNI-NMS management console on your network, because the advisory covers both the switches and the software that manages them, and most SMBs have never written down which one they own.

The affected products in ICSA-25-114-06 are the UNI-NMS-Lite, NMS-500, and NMS-1000V management platforms, plus the WGS-80HPT-V2 and WGS-4215-8T2S switches. These are industrial and building-automation grade devices. In Houston they show up in manufacturing plants, oil and gas facilities, engineering firms with their own labs, and building systems that a property manager installed and forgot. The management software is the higher-value target: compromise the console and you reach every switch it controls.

• Step 1 - Inventory your network gear and management software. Pull a full list of network hardware: switches, the NMS console, wireless controllers, and anything with a web management page. Note the vendor, model, firmware version, IP address, and whether it answers from outside your network. Scan the network rather than trusting a spreadsheet - the device that matters is the one that never made it onto the spreadsheet.

Do not stop at the obvious data closet. A single Planet switch bridging a production line, a security-camera network, or an HVAC controller is exactly the kind of asset that lives outside IT's normal view. In 35 years around this work, the machine that causes the incident is almost always the one nobody knew was still plugged in. Write down the owner of each device too, so you know who to call when the patch window needs sign-off.

Step 2 matches what you found against the specific CVEs, so you patch the real risk instead of guessing.

Step 2 is to check each device's firmware version against the five CVEs in the advisory, because "we have a Planet switch" is not the same as "we have a vulnerable Planet switch" - the firmware version is what decides.

CISA identified five critical vulnerabilities, reported by Kevin Breen of Immersive Labs and disclosed on April 15, 2025. They fall into three attack types, and each one is remotely exploitable by an attacker with no credentials:

• OS command injection - CVE-2025-46271 lets an unauthenticated attacker read or manipulate device data through the UNI-NMS software (CVSS v4 9.3), and CVE-2025-46272 lets an attacker run operating-system commands directly on an affected switch.
• Hard-coded credentials - CVE-2025-46273 and CVE-2025-46274 ship built-in credentials an attacker can use to log in, with the NMS flaw (CVE-2025-46274) rated CVSS v3 9.8 because it allows reading, changing, and creating entries in the managed database.
• Missing authentication - CVE-2025-46275 lets an attacker create a working administrator account on an affected switch without knowing any existing credentials.

• Step 2 - Check firmware and match it to the CVE list. For each device you inventoried, record the running firmware and compare it to the fixed versions Planet published. CISA flagged CVSS scores as high as 9.8 out of 10 and rated the flaws low in attack complexity, so treat any pre-patch device as vulnerable until proven otherwise. Prioritize the internet-reachable devices and the NMS consoles first - they carry the most reach.

One caution on numbers: some early write-ups mixed this advisory with an older 2024 Planet WGS-804HPT advisory (ICSA-24-340-02) that a different research team disclosed. For patching decisions, trust the CVE identifier and the fixed firmware version on the vendor's advisory page, not a headline score. The CVE number is the thing that maps cleanly to a fix.

Step 3 shrinks the attack surface first, so a device stays defensible even during the patch window.

Step 3 is to segment and restrict management access, because pulling these devices off the open internet and behind a firewall removes the remote-attacker path that makes the CVEs critical in the first place.

CISA's own guidance for this advisory is direct: minimize network exposure so control-system devices are not reachable from the internet, put them behind firewalls, and isolate them from the business network. That is not a workaround for a missing patch - it is defense in depth you keep even after patching. A switch that an attacker cannot reach is a switch whose vulnerability cannot be triggered remotely.

• Step 3 - Segment the network and restrict management access. Move Planet switches and the NMS console onto a management VLAN that business users and the internet cannot reach. Block their management interfaces at the firewall. Where remote access is genuinely needed, require a current, patched VPN rather than exposing the device directly. Change any default or shared passwords now, since two of these CVEs turn on credentials that should never have been reachable.

This step is where an operational-technology reality bites Houston businesses specifically. Plant-floor and building-automation gear was often installed to "just work," flat on the same network as everything else, because segmenting it felt like overkill. It is not. Oil and gas sites, manufacturers, and engineering firms across the Gulf Coast run this class of device, and the ones that segmented their control networks are the ones this advisory barely touches. Segmentation is the control that keeps paying off across every future advisory, not just this one.

Steps 4 and 5 close the specific hole and build the habit that catches the next one.

Step 4 is to apply the vendor firmware Planet released on April 16, 2025, and step 5 is to monitor, because a patched device with unmonitored management access is one stale credential away from the same problem.

Planet Technology published fixed firmware and updated management software after Immersive Labs reported the flaws. The patch is available - which means the remaining risk is entirely about devices that never get updated. That is the pattern with almost every advisory: the fix ships fast, and the breaches happen on the machines that stayed on old firmware for months.

• Step 4 - Apply the patch and rotate credentials. Update each affected device to the fixed firmware or management-software version from Planet's advisory. Do a quick impact check before deploying to production control systems, then schedule the window. After patching, rotate every credential on the device, because the hard-coded-credential flaws mean the old ones cannot be trusted. Confirm the version after the update rather than assuming it took.
• Step 5 - Monitor for exploitation and the next advisory. CISA reported no known public exploitation at disclosure, but that changes the moment a working exploit circulates. Watch management interfaces for new accounts, unexpected logins, and configuration changes. Subscribe to CISA ICS advisories so the next Planet or vendor flaw reaches you as an alert, not as an incident.

The reason to keep steps 4 and 5 together is simple. Patching is a one-time event; monitoring is what tells you the patch held and catches the account an attacker created before you closed the door. A managed provider runs both on a schedule so neither depends on someone remembering.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area, turning a CISA advisory like the Planet Technology one into a finished remediation instead of an open worry.

CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10-200 employees. Finding and patching vulnerable network gear takes visibility, discipline, and follow-through - exactly what a managed partner provides:

• Asset inventory and vulnerability scanning. We find every switch and management console on your network and match each against active CVEs, so nothing hides in a closet.
• Network segmentation. We isolate control-system and management devices behind firewalls and off the open internet, the control CISA calls for by name.
• Patch management. We test and deploy vendor firmware with minimal disruption, then confirm the version and rotate credentials.
• Security monitoring. We watch management interfaces for the account creation, logins, and config changes that signal an exploitation attempt.

You do not need an in-house security team to close out an advisory like this one - you need a partner who inventories your gear, knows which CVE maps to which fix, and patches before an exploit lands. If your business in Houston or Katy runs Planet Technology gear, or any network hardware you have not checked lately, especially in manufacturing or oil and gas, talk to CinchOps and we will run the five steps for you.