PLANET IGS-5225-8P2T4S CVE-2026-81944

Requires an authenticated session (PR:L) to the web-based management interface of a PLANET IGS-5225-8P2T4S switch running V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519, plus network reachability to that web server. The specific trigger is sending data that exceeds a fixed-size stack buffer's bounds in the web server's request handling. Limiting factors: valid credentials are needed (not unauthenticated), the management plane must be network-reachable to the attacker, and high attack complexity (AC:H) means reliable code execution requires overcoming device memory-layout/protections - a straightforward crash/DoS is the more accessible outcome. Devices patched to the fixed firmware builds are not affected.

The vendor-assigned CVSS 4.0 base score is 7.7 (High) with vector AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, indicating a network-reachable but authenticated (PR:L) flaw of high attack complexity (AC:H) that, if successfully exploited, fully compromises the affected device's confidentiality, integrity, and availability (SC:N/SI:N/SA:N so no scope change to other systems). This is a genuine dual-outcome weakness: reliable DoS is the likely floor, while arbitrary code execution on the underlying OS is the stated ceiling but is gated by AC:H (exploiting a stack overflow into working RCE typically requires defeating device-specific memory layout/protections). Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing, no EPSS score, and no POC referenced in the provided intelligence; the only sources are the PLANET security advisory and a VulnCheck advisory. Weighing signals: this is a real, patch-worthy priority for anyone operating these specific industrial switches (authenticated attacker on the management plane can crash or potentially own the device), but the combination of required authentication, high attack complexity, and absence of any exploitation/POC evidence keeps it below the tier of an actively-exploited, mass-scannable bug. No conflicting signals were found - the CVSS network vector is consistent with a web-server flaw, and the authenticated qualifier (PR:L) matches the description's 'remote authenticated attacker.'

An attacker who already holds valid (even low-privilege) credentials or an authenticated session to the switch's web management interface sends a crafted HTTP request with an oversized field that overflows a fixed-size stack buffer during copying. This crashes the web server (guaranteed DoS) or, with a device-specific exploit defeating memory protections, executes attacker-controlled code on the switch OS. No public exploit code is referenced, and the high attack complexity (AC:H) means weaponized RCE would require tailored development effort.