PLANET IGS-5225-8P2T4S CVE-2026-81946

Exploitation requires the attacker to first obtain the PLANET IGS-5225-8P2T4S device configuration file (V1 firmware before 1.2412b260707 or V2 before 2.2412b260519), which normally requires local access and existing privileges (PR:H) such as an admin config export, an exposed configuration backup, or physical/local device access. Given the file, the privileged-mode password is stored using MD5 and can be recovered offline. Limiting factors: no network attack vector (AV:L), high privilege prerequisite to reach the config file, no user interaction, and impact confined to confidentiality (credential recovery) with no direct integrity or availability effect. Not exploitable against default configurations without prior access to the config file.

This is a genuine but low-urgency information-disclosure weakness, not a critical remotely-exploitable flaw despite the mid-range 6.7 score. The CVSS 4.0 vector (AV:L/AC:L/PR:H/UI:N/VC:H/VI:N/VA:N) is self-limiting: exploitation requires LOCAL access and HIGH privileges because the attacker must first obtain the device configuration file - normally only accessible to an already-privileged administrator or via a separate compromise/backup exposure. The only impact is confidentiality (VC:H): recovering the privileged-mode password from its weak MD5 hash. There is no VulnCheck/CISA indication of active exploitation, so this is 'no public exploit identified at time of analysis' - no KEV listing, no EPSS score provided, and no POC referenced. Note two data conflicts that lower confidence in the input metadata: the assigned CWE-121 (stack-based buffer overflow) and the 'Buffer Overflow'/'Stack Overflow' tags directly contradict the description, which describes weak MD5 password hashing (properly CWE-916/CWE-327) - these appear mislabeled and should be verified against the vendor advisory. Overall this is a defense-in-depth credential-hardening issue, realistically a priority only where config files are exposed (backups, TFTP, shared storage) or as a privilege-escalation stepping stone.

An attacker who has already obtained a copy of the switch's configuration file - via a config backup left on a TFTP/file share, a lower-privilege export, or physical/local access - extracts the stored MD5 password hash and cracks it offline (MD5 is fast to brute-force/dictionary-attack). The recovered privileged-mode password then grants full administrative control of the industrial switch. No public exploit code is identified, and the attack presupposes prior access to the configuration file.