CVE-2026-77217 in PLANET GS-4210-16P2S
Summary
by MITRE • 08/28/2026
PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The web_radiusSrv*_post family of handlers copies the radKey, radKey_0, radDftParamKey, radName, and radIp POST parameters into fixed-size stack buffers without length validation, and additionally dereferences radName and radIp without verifying their presence in the request. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in PLANET GS-4210-16P2S firmware versions prior to 3.441b260626 represents a critical security flaw within the device's web-based management interface. Specifically, the defect resides in the CGI script located at /cgi-bin/dispatcher.cgi, which serves as the backend processor for various administrative functions. This component is responsible for handling HTTP POST requests that configure network settings and authentication parameters. The core issue stems from inadequate input validation mechanisms when processing specific radius server configuration fields. Because this endpoint requires authentication to access, the vulnerability classifies under authenticated attack scenarios, meaning an adversary must possess valid credentials or otherwise bypass initial access controls before exploitation can occur.
From a technical perspective, the flaw manifests as both a stack buffer overflow and a null pointer dereference within the web_radiusSrv*_post family of handlers. These functions are designed to accept POST parameters including radKey, radKey_0, radDftParamKey, radName, and radIp for configuring RADIUS authentication servers. The implementation copies these input values directly into fixed-size stack buffers without performing any length validation or bounds checking. When an attacker submits a value exceeding the allocated buffer size, it overwrites adjacent memory on the call stack. This classic stack-based buffer overflow can corrupt return addresses or function pointers, potentially allowing for arbitrary code execution if exploited with precise payload construction. However, in this specific instance, the immediate and most reliable outcome is system instability rather than full remote code execution due to modern mitigations like stack canaries often present in embedded systems.
Concurrently, the same handler functions exhibit a null pointer dereference vulnerability regarding the radName and radIp parameters. The code attempts to access these fields without first verifying their presence or validity within the incoming request object. If an authenticated user sends a POST request that omits these specific keys or provides malformed data structures where these pointers are not initialized, the application will attempt to dereference null addresses in memory. This action triggers a segmentation fault, causing the CGI process handling the web management service to crash abruptly. The combination of buffer overflow and null pointer dereference creates multiple vectors for destabilizing the device's administrative interface, highlighting significant deficiencies in defensive coding practices during firmware development.
The operational impact of these vulnerabilities is primarily centered on denial of service conditions. An authenticated attacker can repeatedly send crafted HTTP POST requests containing oversized strings or missing required fields to crash the dispatcher.cgi process. Since this CGI script manages critical network configuration tasks, its failure renders the web management interface unresponsive. This effectively locks out administrators from managing the switch via the GUI, forcing reliance on console access for recovery and remediation. While the primary impact is availability loss, the underlying stack buffer overflow remains a latent threat that could potentially be leveraged for more severe compromise if additional exploitation techniques are applied against other memory corruption vectors in the firmware binary.
In terms of industry standard classifications, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input and CWE-476 NULL Pointer Dereference as defined by Common Weakness Enumeration. The attack vector is categorized under ATT&CK technique T1505.003 Web Shell: CGI Scripts, although in this case the intent is disruption rather than persistence. Furthermore, it falls under CWE-287 Improper Authentication if considering that authenticated access is required to trigger the flaw, emphasizing the importance of robust input validation even for privileged users. The lack of bounds checking on user-supplied data entering critical system processes represents a fundamental failure in secure software development lifecycle practices.
Mitigation strategies focus primarily on firmware updates and network segmentation. PLANET has released version 3.441b260626 which addresses these issues by implementing proper length validation for all incoming POST parameters and adding null checks before pointer dereferencing operations. Administrators should immediately upgrade to this patched version or later. In environments where immediate patching is not feasible, restricting access to the web management interface through firewall rules can limit exposure. Additionally, enforcing strong authentication policies reduces the risk of unauthorized actors reaching the vulnerable endpoint. Regular auditing of firmware versions and applying security patches promptly are essential practices for maintaining the integrity and availability of network infrastructure devices susceptible to such implementation flaws.