PLANET Technology Corp. PLANET GS-4210-16P2S up to 3.441b260625 CGI /cgi-bin/dispatcher.cgi usrPass/enbPass/usrName stack-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in PLANET Technology Corp. PLANET GS-4210-16P2S up to 3.441b260625. The affected element is the function web_login_first_post/web_sys_enablePasswd_post/web_sys_localUser_post of the file /cgi-bin/dispatcher.cgi of the component CGI Handler. Performing a manipulation of the argument usrPass/enbPass/usrName results in stack-based overflow. This vulnerability is reported as CVE-2026-77218. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in PLANET Technology Corp. PLANET GS-4210-16P2S up to 3.441b260625. It has been classified as critical. This affects the function web_login_first_post/web_sys_enablePasswd_post/web_sys_localUser_post of the file /cgi-bin/dispatcher.cgi of the component CGI Handler. The manipulation of the argument usrPass/enbPass/usrName with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on availability. The summary by CVE is:

PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web_login_first_post handler copies the usrPass POST parameter into a fixed-size stack buffer without length validation, the web_sys_enablePasswd_post handler copies the enbPass POST parameter into a fixed-size stack buffer without length validation, and the web_sys_localUser_post handler copies the usrName and usrPass POST parameters into fixed-size stack buffers without length validation. A remote authenticated attacker can send a crafted request to crash the CGI process or web management service, resulting in denial of service.

The advisory is shared at planet.com.tw. This vulnerability is uniquely identified as CVE-2026-77218 since 08/20/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

Upgrading to version 3.441b260626 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• PLANET Technology Corp.

Name

• PLANET GS-4210-16P2S

Version

• 3.441b260625

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion