PLANET GS-4210-16P2S CVE-2026-75121

Exploitation requires valid administrative (high-privilege) credentials to the GS-4210-16P2S web management interface, confirmed by CVSS PR:H. The attacker must have network-layer access to the device's HTTP management port - if the management interface is bound only to an internal management VLAN, network-segment access to that VLAN is also required. The vulnerable code path is specifically triggered through the VLAN membership editing function (web_vlan_membership_edit_dialog_post handler); the attacker must reach this specific handler via a POST request to /cgi-bin/dispatcher.cgi. Exploitation is not possible without prior authentication - this is the primary limiting factor. No special non-default configuration is required beyond the management interface being enabled, which is the default operational state for managed switches.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.6, reflecting high network reachability and full C/I/A impact, but critically constrained by PR:H - administrative credentials are required. This is the single most significant limiting factor: an unauthenticated network attacker cannot exploit this directly. In practice, risk is elevated in environments where admin credentials are shared, default credentials are in use, or where the management interface is exposed beyond the internal management VLAN. No KEV listing and no public POC exist at time of analysis, meaning exploitation remains theoretical or limited to actors with prior credential access. EPSS data is not provided; real-world exploitation probability is assessed as low-to-moderate absent credential exposure. The absence of a scope change (SC:N) confirms impact is contained to the switch itself - lateral movement would require additional steps. Priority should be elevated for any deployment with internet-facing or broadly accessible management interfaces.

An attacker who has obtained administrator credentials to the PLANET GS-4210-16P2S web management interface - whether through credential theft, brute force against weak or default passwords, or insider access - sends a crafted HTTP POST request to /cgi-bin/dispatcher.cgi with a memberTags value containing shell metacharacters (e.g., memberTags=1; id > /tmp/pwned). The device's CGI handler passes this value unsanitized to a shell command, executing the injected command with the privilege level of the web server process. No public exploit code is identified at time of analysis, but the vulnerability is straightforward to exploit manually given authenticated access.