CVE-2026-75121 in PLANET GS-4210-16P2S
Summary
by MITRE • 08/28/2026
PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_vlan_membership_edit_dialog_post handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated attacker can send a crafted memberTags value to execute arbitrary operating-system commands on the device.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/29/2026
The PLANET GS-4210-16P2S managed switch, specifically firmware versions prior to 3.441b260626, contains a critical authenticated OS command injection vulnerability within its web management interface. This flaw is located in the /cgi-bin/dispatcher.cgi script, which serves as the backend handler for various administrative tasks performed through the device's graphical user interface. The specific point of failure occurs when processing HTTP POST requests directed at the web_vlan_membership_edit_dialog_post endpoint. In this context, the application fails to properly validate or sanitize input data before incorporating it into system-level operations, creating a direct pathway for attackers to execute arbitrary commands on the underlying operating system with the privileges associated with the CGI process.
The technical root cause of this vulnerability lies in the improper handling of the memberTags parameter within POST requests. When an authenticated user submits VLAN membership configuration changes via the web interface, the dispatcher.cgi script accepts the value provided in the memberTags field and passes it directly to a shell command interpreter without applying any filtering or escaping mechanisms. This lack of input sanitization means that special characters with shell metacharacter significance, such as semicolons, ampersands, pipes, or backticks, are interpreted by the operating system's command processor rather than being treated as literal data. Consequently, an attacker can craft a malicious payload within this parameter to terminate the intended command and append additional arbitrary commands for execution.
From an operational perspective, this vulnerability allows any authenticated user with access to the web management interface of the affected switch to achieve remote code execution on the device's operating system. Since network switches often run embedded Linux or similar Unix-like systems, gaining a shell via CGI injection typically results in full control over the host environment. This can lead to severe consequences including the compromise of sensitive network configuration data, modification of routing tables, installation of persistent backdoors for future access, and using the switch as a pivot point to attack other devices on the internal network segment. The requirement for authentication does not mitigate the risk significantly in environments where credentials may be shared among multiple administrators or staff members with varying levels of trustworthiness.
This vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically under the sub-category for Unix Shell commands (T1059.004). The attack vector involves interacting with a web service that requires prior authentication, which classifies it as an authenticated remote exploitation scenario. Attackers would typically use tools like curl or custom scripts to send crafted HTTP POST requests containing shell metacharacters within the memberTags parameter to trigger arbitrary command execution.
To mitigate this risk, organizations must immediately upgrade the firmware on all affected PLANET GS-4210-16P2S switches to version 3.441b260626 or later, where the vendor has implemented proper input validation and sanitization for the memberTags parameter. Until patching is complete, it is advisable to restrict access to the web management interface using network segmentation rules, allowing only trusted IP addresses to connect via HTTPS. Additionally, enforcing strong password policies and limiting administrative account creation can reduce the attack surface by minimizing the number of potential authenticated users who could exploit this flaw. Regular monitoring for unusual outbound connections or unexpected process executions on the switch may also help in detecting exploitation attempts early.