PLANET GS-4210-16P2S CVE-2026-75124

Exploitation requires only network-level connectivity to the GS-4210-16P2S web management interface - no credentials, no session tokens, and no prior access to the device are needed. The vulnerability is pre-authentication and triggered via a standard HTTP GET request, meaning it is reachable in a single unauthenticated packet exchange. Devices whose management interface is reachable from untrusted networks (internet-exposed management ports, flat enterprise networks without management VLAN separation) are directly at risk with no additional attacker capability required. The primary factor limiting exploitation scope is network segmentation: devices whose management interface is firewalled to management-only hosts cannot be reached by external or lateral attackers.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N scoring 8.7 accurately reflects the ease-of-reach: no authentication, no complexity, no user interaction, network-accessible. The impact metrics are conservatively scoped to high availability impact on the vulnerable system only, with no confidentiality or integrity impact confirmed - this aligns with the described worst-confirmed outcome of crashing the web management interface. However, the description explicitly notes the potential for memory corruption beyond DoS, which the CVSS scoring does not fully capture; if the stack overflow is reliably exploitable for code execution, real-world risk would be materially higher than the score implies. EPSS data is absent from available intelligence, so exploitation probability relative to the broader CVE population cannot be quantified. KEV status is not confirmed, and no public exploit code has been identified, meaning current threat actor activity is unknown. The realistic immediate priority is for any organization running management interfaces on flat or internet-exposed network segments - even a mid-sized operator with limited patching cadence should treat this as urgent given the zero-prerequisite attack path. The key mitigating factor is that impact is bounded to the management plane; data-plane forwarding continues unaffected by a web UI crash.

An attacker with network access to the GS-4210-16P2S web management port sends a single crafted HTTP GET request to dispatcher.cgi containing a query string that substantially exceeds the fixed stack buffer size allocated in parse_query_string. The _readHttpParam function copies the full oversized string without truncation or NUL termination, and parse_query_string then walks past the buffer boundary on the stack, corrupting adjacent memory and crashing the web management process. Depending on firmware memory protections, a carefully crafted payload could attempt to overwrite a return address, though reliable code execution exploitation has not been confirmed by available data.