CVE-2026-75124 in PLANET GS-4210-16P2S
Summary
by MITRE • 08/28/2026
PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to dispatcher.cgi to cause denial of service of the web management interface and potentially trigger memory corruption.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in PLANET GS-4210-16P2S firmware versions prior to 3.441b260626 represents a critical pre-authentication flaw within the device's embedded web management interface. This security defect is rooted in improper input validation and boundary checking mechanisms during the processing of HTTP requests, specifically affecting the _readHttpParam function. The core technical issue arises from the failure to ensure NUL termination when copying an oversized HTTP query string into a fixed-size stack buffer. In C-based firmware development, strings must be properly terminated with a null character to delineate their end; without this guarantee, subsequent parsing functions operate on undefined memory boundaries, leading to potential out-of-bounds reads or writes that compromise the integrity of the system's runtime environment.
From an operational perspective, this vulnerability allows any unauthenticated remote attacker to interact directly with the dispatcher.cgi endpoint via a specially crafted GET request. By supplying a query string that exceeds the expected buffer size, the attacker can trigger a denial of service condition against the web management interface. The immediate impact is the disruption of administrative access and network monitoring capabilities for managed devices relying on this switch model. While the primary observed effect is a crash or hang resulting in availability loss, the underlying memory corruption poses a more severe latent risk. Improperly terminated strings can lead to stack-based buffer overflows, which may allow an attacker to overwrite adjacent memory locations, potentially executing arbitrary code with the privileges of the web server process if exploitation techniques are further refined beyond simple denial of service vectors.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) standards, specifically CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write. The lack of input validation corresponds to CWE-20 Improper Input Validation, as the system fails to verify that user-supplied data conforms to expected length constraints before processing. In terms of attack taxonomy, this flaw facilitates exploitation consistent with MITRE ATT&CK technique T1190 Exploit Public-Facing Application, where adversaries leverage vulnerabilities in internet-facing services to gain initial access or disrupt operations. The pre-authentication nature of the exploit means that no valid credentials are required, significantly lowering the barrier for entry and increasing the likelihood of automated scanning and exploitation by malicious actors targeting IoT infrastructure.
Mitigation strategies must prioritize immediate firmware updates to version 3.441b260626 or later, where these buffer handling issues have been rectified through rigorous input sanitization and bounds checking implementations. For environments where patching is not immediately feasible, network-level controls should be implemented to restrict access to the management interface exclusively from trusted IP ranges using firewall rules or VLAN segmentation. Additionally, deploying intrusion detection systems configured to detect anomalous HTTP request patterns, such as unusually long query strings targeting dispatcher.cgi, can provide an additional layer of defense by identifying and blocking exploitation attempts before they reach the vulnerable application logic. Regular security assessments focusing on embedded web interfaces are recommended to identify similar weaknesses in other network infrastructure components.