Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 version 1.3411b190912. These vulnerabilities can be triggered by sending a specially crafted network request containing the new_device_name parameter, allowing arbitrary command execution on the device. The vulnerabilities have a high severity with a CVSS score of 8.8.