PLANET GS-4210-16P2S CVE-2026-75126

Exploitation requires authentication as a high-privilege administrator on the PLANET GS-4210-16P2S web management interface, as confirmed by the CVSS 4.0 PR:H metric. The attacker must be able to reach the switch's HTTP or HTTPS web management port from the network (AV:N). No special non-default device configuration is required: the affected handlers cover standard management functions (VLAN, SNMP v3, ACL, AAA, DHCP option 82, STP, PoE) that are part of the product's normal operational state. Exploitation is limited to devices running firmware prior to 3.441b260626. The key limiting factors are: (1) the administrative credential prerequisite, which prevents unauthenticated exploitation and requires prior compromise of credentials; (2) network reachability to the management interface, which in hardened deployments is isolated to dedicated management VLANs or subnets inaccessible from untrusted networks; and (3) the confirmed impact ceiling of denial of service only - no code execution has been documented for this vulnerability.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H) accurately characterizes this vulnerability: network-reachable with low attack complexity, but gated behind a high-privilege authentication requirement (PR:H) that substantially constrains real-world exploitability. An unauthenticated network adversary cannot trigger this vulnerability - valid administrator credentials must first be obtained, making this a post-compromise or insider-threat scenario rather than an internet-facing attack surface. The confirmed impact is limited to availability (VA:H); the CVSS vector explicitly records no confidentiality or integrity impact (VC:N/VI:N), and the vendor description corroborates this with 'denial of service' as the sole stated outcome. While stack-based buffer overflows on embedded network devices theoretically carry RCE potential, neither the vendor advisory nor the VulnCheck report documents code execution, and no further claim is made here. No EPSS score was provided; given the niche product footprint and PR:H prerequisite, opportunistic mass exploitation is implausible. The vulnerability is not in CISA KEV. The primary concern is the systemic nature of the flaw - 30+ handlers affected - which makes the management interface unreliable until patched, even though the attacker must already be authenticated.

An attacker who has obtained administrator credentials to a GS-4210-16P2S switch - through credential theft, phishing of a network operator, or exploitation of a default or weak password - authenticates to the web management interface and sends a crafted HTTP POST request to /cgi-bin/dispatcher.cgi targeting one of the 30+ vulnerable handlers with an oversized parameter value. The unchecked stack copy corrupts the CGI process stack frame, causing the web management service to crash and rendering the device's management interface unavailable until the process restarts or the device is rebooted. No public exploit code has been identified, so exploitation requires a moderately capable attacker with prior access to valid administrative credentials.