PLANET GS-5220-8P2T2S V3
CVE
Summary
PLANET Technology has addressed two security vulnerabilities affecting the web management interface of the GS-5220-8P2T2S V3 (Hardware Version 3.0): an unauthenticated stack-based buffer overflow in the webstax_auth HTTP Cookie handling (CVE-2026-109445), and a session-cookie authentication weakness that could allow an authenticated low-privileged user to obtain administrator privileges (CVE-2026-2336). Both vulnerabilities are fixed in firmware v3.2412b261022. The fix for CVE-2026-109445 was verified on a physical GS-5220-8P2T2S V3 device, with a PASS result. Customers are advised to install firmware v3.2412b261022 once it is available on the official PLANET website and restrict management-interface access to trusted networks.
What Are the Risks Associated with These Vulnerabilities?
CVE-2026-109445 (Unauthenticated Stack-Based Buffer Overflow / CWE-121):
In affected firmware, an unauthenticated remote attacker can trigger a stack-based buffer overflow by supplying an oversized webstax_auth HTTP Cookie value to the web management interface. Due to insufficient input length validation, the oversized value can overflow a fixed-size stack buffer. In a QEMU-based firmware test, the researcher demonstrated stack-memory corruption and overwrite of a saved return address. This could cause web management disruption or denial of service (DoS). Remote code execution on physical hardware has not been confirmed. This vulnerability is addressed in firmware v3.2412b261022.CVSS v4.0: 9.3 (Critical); CVSS v3.1: 9.8 (Critical).
CVE-2026-2336 (Weak Session Cookie Authentication / CWE-331):
A user already authenticated with low privileges may recover the shared device-cookie secret from their own webstax_auth session cookie and forge a cookie with administrator privileges, resulting in privilege escalation. This issue requires an authenticated low-privileged user and is not an unauthenticated attack. This issue is addressed in firmware v3.2412b261022. CVSS v4.0: 8.7 (High); CVSS v3.1: 8.8 (High).
Which Versions Are Affected and What Should You Do?
After a comprehensive investigation, we have identified the impacted product versions and released updated firmware to mitigate These Vulnerabilities.
The affected products and available patches are listed in the table below:
How to Get Assistance
If you have any questions or require assistance, please contact PLANET's technical support team or reach out to your PLANET distributor. We are here to provide additional guidance and support.
Acknowledgment
We would like to express our appreciation to Tianchang Yang and Syed Rafiul Hussain (SyNSec Lab, Penn State University) for reporting these issues. for reporting these issues.
Revision History
[2026 - 11 - 13 ]: Initial Version
