PLANET GS-4210-16P2S CVE-2026-77217

Exploitation requires valid high-privilege (administrative) credentials to the GS-4210-16P2S web management interface, as confirmed by PR:H in the CVSS 4.0 vector - unauthenticated exploitation is not possible. The attacker must have network reachability to the device's HTTP management port. The vulnerable RADIUS configuration handlers (web_radiusSrv*_post) are part of the standard firmware web interface and do not require any non-default configuration to be present. The stack buffer overflow is triggered by supplying oversized values for any of the POST parameters radKey, radKey_0, radDftParamKey, radName, or radIp; the null pointer dereference path is triggered by omitting radName or radIp from the request body. Impact is strictly bounded to denial of service against the web management process (VA:H); the CVSS vector confirms no confidentiality or integrity exploitation path, and no evidence of RCE capability is documented in available sources.

The CVSS 4.0 score of 6.9 reflects a network-accessible attack vector but is substantially moderated by the high-privilege authentication requirement (PR:H), which is the primary risk-reduction factor for this vulnerability. The impact is strictly limited to availability - crashing the web management process - with no confidentiality or integrity exposure, as confirmed by VC:N/VI:N/VA:H in the CVSS 4.0 vector. No EPSS data was provided, the vulnerability is absent from the CISA KEV catalog, and no public exploit code has been identified, all of which collectively indicate low active exploitation pressure. For organizations that follow standard network hardening by restricting management-plane access to a dedicated VLAN or jump host, the attack surface is further reduced: an adversary would need both network reachability to the management interface and valid high-privilege credentials. This combination makes opportunistic mass exploitation improbable. The vulnerability is a genuine concern in environments with weak credential hygiene or where the management interface is exposed on untrusted segments, but it does not represent an emergency patch situation - a normal patch cycle is appropriate.

An attacker who has obtained valid administrative credentials - through phishing, credential reuse, or a compromised management workstation - authenticates to the GS-4210-16P2S web interface and submits a POST request to /cgi-bin/dispatcher.cgi with an oversized radKey or radIp parameter exceeding the fixed buffer size, triggering a stack buffer overflow in the RADIUS configuration handler and crashing the CGI or web management service. Alternatively, a request omitting radName or radIp entirely triggers the null pointer dereference path and achieves the same denial-of-service outcome. No public exploit code has been identified at time of analysis.