PLANET GS-4210-16P2S CVE-2026-77218

Authentication to the switch's web management interface is required prior to exploitation - the CVSS 4.0 vector specifies PR:H (High Privileges Required), confirming that valid administrative credentials must be held by the attacker before any of the three overflow conditions can be triggered. The web management service must be reachable over the network (default for managed switch deployments), but network-level ACLs can restrict this. The three vulnerable code paths are reached via specific POST actions: credential handling via web_login_first_post, password enable configuration via web_sys_enablePasswd_post, and local user management via web_sys_localUser_post. Exploitation impact is strictly limited to denial of service against the CGI/web management process - no remote code execution has been demonstrated. CLI-based management channels (SSH, Telnet if enabled) are likely unaffected by a CGI crash, limiting operational disruption. All firmware versions prior to 3.441b260626 running the default web management configuration are affected.

The CVSS 4.0 score of 6.9 (Medium) accurately reflects the constrained threat model: Network attack vector and Low complexity are offset by the High privilege requirement (PR:H), meaning an attacker must already hold valid administrative credentials before triggering any of the three overflow conditions. There is no confidentiality or integrity impact - only High availability impact against the vulnerable system's web management service. No EPSS data was provided in the input, and this vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. No public POC has been identified at time of analysis. The combination of required prior authentication, DoS-only impact, and no active exploitation makes this a manageable finding suited to a standard patch maintenance cycle rather than an emergency response; even a well-resourced network operations team managing dozens of such switches should be able to absorb this into scheduled firmware maintenance without elevated urgency. The primary realistic threat actor is an insider or an attacker who has separately compromised management credentials.

An attacker with valid administrative credentials for the switch's web management interface crafts an HTTP POST request to /cgi-bin/dispatcher.cgi targeting one of the three vulnerable handlers, supplying a usrPass, enbPass, or usrName value that exceeds the fixed-size stack buffer allocated by the handler. The CGI process crashes, making the web management interface unresponsive and requiring a service restart or device reboot to restore management access. No public POC has been identified at time of analysis.