PLANET GS-4210-16P2S CVE-2026-75122

Exploitation requires valid administrator-level credentials for the GS-4210-16P2S web management interface, as confirmed by PR:H in the CVSS 4.0 vector - attackers without admin access cannot exploit this vulnerability directly. The attacker must reach the device's web management port over the network (AV:N); if the management interface is bound to an isolated management VLAN or blocked at the perimeter, network reachability is the primary limiting factor. The specific vulnerable operation is a certificate upload request to /cgi-bin/httpuploadcert.cgi, so the web management interface must be enabled. No user interaction beyond the attacker's own session is required (UI:N), and no special attack timing or race conditions apply (AT:N, AC:L). Exploitation is directly limited by the administrative credential requirement; environments enforcing strong, unique admin passwords and restricting management interface network access face substantially reduced realistic risk despite the CVSS 4.0 score of 8.6.

The CVSS 4.0 score of 8.6 with PR:H correctly captures that administrator credentials are a hard prerequisite, meaningfully reducing the population of potential exploiters relative to unauthenticated vulnerabilities. AC:L and AT:N confirm that no further complexity or special attack preconditions are needed once credentials are in hand. EPSS data is absent from the provided intelligence; given no KEV listing and no confirmed public POC, opportunistic mass exploitation appears unlikely at this time, but targeted exploitation by an attacker who has already obtained admin credentials through phishing, credential reuse, or brute force is mechanically trivial given the elementary nature of unsanitized shell injection. Full C/I/A impact on the switch OS carries disproportionate network-level consequences: arbitrary command execution on a PoE switch can enable persistent backdoor installation, traffic interception via port mirroring, VLAN manipulation, or firmware replacement - risks that the CVSS 4.0 SC/SI/SA:N metrics may understate in practice. The absence of active exploitation signals suggests this remains a patch-priority rather than emergency-response situation for most operators, but any environment where the management interface is internet-reachable or credentials are shared should treat remediation as urgent.

An attacker who has obtained GS-4210-16P2S administrator credentials through credential reuse, phishing, or brute force logs into the web management interface from any network-reachable host and submits a certificate upload request to /cgi-bin/httpuploadcert.cgi with a password field containing injected shell metacharacters - for example, a semicolon followed by a reverse shell command. The firmware passes the unsanitized field directly to a shell interpreter, granting the attacker arbitrary OS-level command execution on the switch. No public POC has been confirmed, but the injection pattern is elementary and reproducible by any attacker with valid credentials.