CVE-2025-9971
Published: 17 September 2025
Summary
CVE-2025-9971 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Org (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-9971 is a Missing Authentication vulnerability (CWE-306) affecting certain models of Industrial Cellular Gateway devices developed by Planet Technology. Published on 2025-09-17, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for complete compromise without prerequisites. The flaw enables unauthenticated remote attackers to manipulate the device through a specific functionality lacking proper authentication controls.
Any unauthenticated attacker with network access to the affected gateway can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows full control over the device, resulting in high impacts to confidentiality, integrity, and availability, such as unauthorized configuration changes, data access, or denial of service.
Mitigation guidance and further details are provided in advisories from Planet Technology at https://www.planet.com.tw/en/support/security-advisory/8 and TWCERT at https://www.twcert.org.tw/en/cp-139-10390-7ce12-2.html and https://www.twcert.org.tw/tw/cp-132-10389-265a3-1.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-29691
Vulnerability details
Certain models of Industrial Cellular Gateway developed by Planet Technology have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to manipulate the device via a specific functionality.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on a network-accessible functionality in a public-facing industrial gateway directly enables remote exploitation for initial access and full device control.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 identifies and authorizes only explicitly permitted actions without authentication, directly preventing exploitation of the missing authentication vulnerability in the specific device functionality.
AC-3 enforces approved access control policies requiring authentication for logical access to system resources, comprehensively mitigating unauthenticated remote manipulation.
AC-17 authorizes and controls remote access to systems, limiting exposure to unauthenticated remote attackers targeting the industrial cellular gateway.