Skip to main content

PLANET GS-4210-16P2S CVE-2026-75125

| EUVDEUVD-2026-67785 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-08-28 VulnCheck GHSA-rmw4-p4vg-g29j
Denial Of Service Null Pointer Dereference Planet Gs 4210 16P2S
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.9 MEDIUM

Network-reachable web interface requires high-privilege authentication (PR:H); impact is solely a CGI process crash with no confidentiality or integrity exposure and unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 28, 2026 - 20:58 vuln.today

DescriptionCVE.org

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_alive_rmtip_post handler dereferences the rmtIP parameter without verifying its presence. A remote authenticated attacker can send a crafted request omitting the rmtIP parameter to cause the CGI process to dereference a null pointer and crash, resulting in denial of service of the web management interface.

AnalysisAI

Null pointer dereference in PLANET GS-4210-16P2S managed switch firmware before 3.441b260626 allows remote authenticated attackers to crash the web management interface by sending a crafted request. The web_poe_alive_rmtip_post handler in /cgi-bin/dispatcher.cgi dereferences the rmtIP POST parameter without first validating its presence, meaning a missing parameter is dereferenced as NULL, faulting the CGI process and rendering the web management interface unavailable. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated session with high-privilege (administrator-level) credentials to the device's web management interface, confirmed by PR:H in the CVSS 4.0 vector - unauthenticated or low-privilege users cannot trigger this condition. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.9 accurately captures the risk profile: network-accessible (AV:N) and low complexity (AC:L), but gated behind high-privilege authentication (PR:H) with impact confined entirely to availability (VA:H) - no confidentiality or integrity impact in either the vulnerable system or subsequent systems (SC:N/SI:N/SA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade PLANET GS-4210-16P2S firmware to version 3.441b260626 or later as documented in the vendor security advisory at https://www.planet.com.tw/en/support/security-advisory/10. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Planet Gs 4210 16P2S

View all
CVE-2026-75124 HIGH
8.7 Aug 28

Stack buffer overflow in the PLANET GS-4210-16P2S managed switch web management interface exposes all firmware versions

CVE-2026-75123 HIGH
8.6 Aug 28

OS command injection in PLANET GS-4210-16P2S managed switch firmware allows a remote attacker with administrator web cre
CVE-2026-75122 HIGH
8.6 Aug 28

Authenticated OS command injection in PLANET GS-4210-16P2S managed switch firmware prior to 3.441b260626 enables a remot
CVE-2026-75121 HIGH
8.6 Aug 28

OS command injection in the PLANET GS-4210-16P2S managed PoE switch firmware before 3.441b260626 allows an authenticated
CVE-2026-77218 MEDIUM
6.9 Aug 28

Stack-based buffer overflow vulnerabilities in the PLANET GS-4210-16P2S managed PoE switch web management interface allo
CVE-2026-77217 MEDIUM
6.9 Aug 28

Stack-based buffer overflow and null pointer dereference vulnerabilities in the PLANET GS-4210-16P2S managed PoE switch

CVE-2026-75126 MEDIUM
6.9 Aug 28

Stack-based buffer overflows in PLANET GS-4210-16P2S managed switch firmware before 3.441b260626 allow a remote administ

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-75125 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy