Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 version 1.3411b190912. These vulnerabilities can be triggered by sending a specially crafted network request containing the `new_password` parameter, allowing arbitrary command execution on the device.