PLANET IGS-5225-8P2T4S EUVD-2026-82987

Requires network reachability to the switch's web management server AND valid low-privilege authentication (PR:L) - exploitation is not possible against an unauthenticated attacker. Affected firmware: IGS-5225-8P2T4S V1 before 1.2412b260707 and V2 before 2.2412b260519; patched builds are fixed. No user interaction is needed (UI:N). Realistic limiting factors: the web management interface should not be exposed to untrusted networks, credentials are required, and the affected product is a specialized industrial managed switch typically on segmented OT networks, narrowing the attack surface.

This is a genuine high-priority vulnerability, not a CVSS-inflated one. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, 8.7) is internally consistent with the description: a remote, low-privileged authenticated attacker sends web-server input that reaches system() unfiltered, yielding full confidentiality/integrity/availability impact via privilege escalation to root. The signals partly conflict on urgency: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation yet - this points to a serious-but-not-yet-widely-exploited issue. The single mitigating factor is PR:L: exploitation requires valid web-management credentials, which on a properly segmented OT/management network limits the attacker population. No SSVC decision data was provided. Overall: treat as a priority patch for any exposed or shared-credential deployment, but the low real-world footprint and authentication requirement temper mass-exploitation risk.

An attacker with valid low-privilege web credentials (or who has phished/reused default management logins) reaches the switch's web interface and submits crafted input into a vulnerable field that the server passes to system(). The injected shell metacharacters execute arbitrary OS commands, escalating the attacker to root on the switch. No public exploit code was identified at time of analysis, but the flaw is a straightforward command-injection primitive that is trivial to weaponize once the vulnerable parameter is known.