PLANET Technology has identified and addressed multiple security vulnerabilities affecting the web management interface of the GS-4210-16P2S V3 Managed Gigabit Switch.
The issues include three authenticated operating-system command-injection vulnerabilities, one pre-authentication memory-corruption vulnerability, an authenticated NULL pointer dereference, and authenticated stack-buffer-overflow conditions affecting standard, RADIUS, and credential-management handlers. Successful exploitation could allow an attacker with the required web-management privileges to execute operating-system commands or disrupt the web-management service. The query-string parsing issue can be triggered before authentication.
Patched firmware has been fully verified and released. The update is available for download from the PLANET official website. All users are strongly recommended to upgrade immediately.
CVE-2026-75121 (Authenticated OS Command Injection / CWE-78):
Affects /cgi-bin/dispatcher.cgi (web_vlan_membership_edit_dialog_post, cmd=1552). The memberTags POST parameter is incorporated into a shell command without adequate sanitization. A remote attacker with administrator-level web-management privileges can submit a crafted value to execute arbitrary operating-system commands on the device. CVSS v4.0: 8.6 (High), CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CVSS v3.1: 7.2 (High), CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
CVE-2026-75122 (Authenticated OS Command Injection / CWE-78):
Affects /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate-upload request is incorporated into a shell command without sanitization of shell metacharacters. A remote attacker with administrator web credentials can submit a crafted certificate-upload request to execute arbitrary operating-system commands on the device. CVSS v4.0: 8.6 (High), CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CVSS v3.1: 7.2 (High), CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
CVE-2026-75123 (Authenticated OS Command Injection / CWE-78):
Affects /cgi-bin/dispatcher.cgi (web_smtp_test_post, cmd=9986). The caller-supplied SMTP server value is incorporated into a shell command without adequate sanitization. A remote attacker with administrator web credentials can send a crafted server value to execute arbitrary operating-system commands on the device. CVSS v4.0: 8.6 (High), CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CVSS v3.1: 7.2 (High), CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
CVE-2026-75124 (Pre-authentication Memory Corruption / CWE-120):
Affects the /cgi-bin/dispatcher.cgi HTTP query-string parsing path (_readHttpParam and parse_query_string). An oversized query string may be copied without guaranteed NUL termination and processed into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to cause denial of service of the web-management interface and potentially trigger memory corruption. CVSS v4.0: 8.7 (High), CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. CVSS v3.1: 7.5 (High), CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
CVE-2026-75125 (NULL Pointer Dereference DoS / CWE-476):
Affects /cgi-bin/dispatcher.cgi (web_poe_alive_rmtip_post, cmd=9223). The affected handler dereferences the rmtIP parameter without first verifying that it is present. A remote authenticated attacker with administrator-level web-management privileges can omit rmtIP to crash the CGI process and disrupt the web-management interface. CVSS v4.0: 6.9 (Medium), CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. CVSS v3.1: 4.9 (Medium), CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H.
CVE-2026-75126 (Stack Buffer Overflow in Standard Handlers / CWE-121):
Affects multiple authenticated standard web-management handlers in /cgi-bin/dispatcher.cgi. The affected handlers are web_vlan_membership_edit_dialog_post; web_dai_vlan_post; web_poe_alive_rmtip_post; web_sys_sntp_post; web_tool_upgradeManager_post; web_port_countersClr_post; web_rmon_statisticsClr_post; web_cablediag_copper_post; web_aaa_*Authlist* handlers; web_acl_mgmt_Rules_Apply_post; web_acl_mgmt_Rules_Edit_post; web_acl_*AceDel_post handlers; web_acl_*AceAdd/Edit_post handlers; web_acl_bindAdd_post; web_acl_bindEdit_post; web_snmp_v3view_add_post; web_snmp_v3group_add_post; web_snmp_v3community_add_post; web_snmp_v3host_add_post; web_snmp_notifyv3_add_post; web_snmp_v3user_add_post; web_snmpv3_remote_engineId_add_post; web_stp_globalSetting_post; web_isg_db_post; web_tacplus*_post handlers; web_dhcp_option82_post; and web_dhcp_port_option82_cid_post. These handlers copy attacker-controlled POST parameters into fixed-size stack buffers without length validation. A remote authenticated attacker can send crafted requests to crash the CGI process or web-management service, resulting in denial of service. CVSS v4.0: 6.9 (Medium), CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. CVSS v3.1: 4.9 (Medium), CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H.
CVE-2026-77217 (Stack Buffer Overflow and NULL Pointer Dereference in RADIUS Handlers / CWE-121, CWE-476):
Affects the web_radiusSrv*_post handler family in /cgi-bin/dispatcher.cgi (cmd=7936, 7938, and 7940). The radKey, radKey_0, radDftParamKey, radName, and radIp POST parameters may be copied into fixed-size stack buffers without adequate length validation; radName and radIp may also be dereferenced without verifying their presence. A remote authenticated attacker with administrator-level web-management privileges can send a crafted request to crash the CGI process or web-management service. CVSS v4.0: 6.9 (Medium), CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. CVSS v3.1: 4.9 (Medium), CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H.
CVE-2026-77218 (Stack Buffer Overflow in Credential Handlers / CWE-121):
Affects credential-management handlers in /cgi-bin/dispatcher.cgi: web_login_first_post (cmd=17, usrPass), web_sys_enablePasswd_post (cmd=522, enbPass), and web_sys_localUser_post (cmd=525, usrName and usrPass). Crafted POST values may overflow fixed-size stack buffers and crash the CGI process or web-management service. A remote authenticated attacker must have administrator-level access to the affected credential workflows. CVSS v4.0: 6.9 (Medium), CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. CVSS v3.1: 4.9 (Medium), CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H.
After a comprehensive investigation, we have identified the impacted product versions and released updated firmware to mitigate this vulnerability.
The affected products and available patches are listed in the table below:
If you have any questions or require assistance, please contact PLANET's technical support team or reach out to your PLANET distributor. We are here to provide additional guidance and support.
We would like to express our appreciation to Jincheng Wang (@winmt), Professor Le Yu of Nanjing University of Posts and Telecommunications, and Professor Xiapu Luo of The Hong Kong Polytechnic University for reporting this issue.
