Planet Igs 5225 8P2T4S V1
Monthly
Stack-based buffer overflow in the web management server of PLANET IGS-5225-8P2T4S industrial managed switches allows a remote authenticated administrator to crash the device or, with carefully crafted input, potentially execute arbitrary code on the underlying operating system. Affected devices run V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519, and exploitation requires valid administrative credentials plus network reachability to the switch's management interface; the high attack complexity means many payloads will only produce a denial of service rather than code execution. No public exploit has been identified at time of analysis, and PLANET has released fixed firmware for both branches.
Stack-based buffer overflow in the web management server of PLANET IGS-5225-8P2T4S industrial managed switches lets an authenticated remote attacker (PR:L) crash the device for a denial of service or, with greater effort, execute arbitrary code on the underlying operating system. Affected are V1 firmware before 1.2412b260707 and V2 firmware before 2.2412b260519; exploitation requires network reachability to the switch web interface, valid credentials, and high attack complexity (AC:H) to achieve reliable code execution, so a straightforward crash/DoS is the more accessible outcome. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis; vendor firmware fixes are available.
Privileged users of PLANET IGS-5225-8P2T4S industrial managed switches running V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519 can activate undocumented debug functionality that ships enabled in the embedded software, reaching an OS command execution path that grants root-level access to the device. Exploitation requires high-privilege administrative/management access and local access to the device management plane (CVSS:4.0 AV:L/PR:H), so the realistic threat is a malicious insider or an attacker who has already obtained management credentials rather than an unauthenticated remote compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor-released patched firmware is available.
OS command injection in the web management server of PLANET IGS-5225-8P2T4S industrial managed switches lets a remote, low-privilege authenticated attacker run arbitrary operating-system commands and obtain root on the device. Only switches running V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519 are affected; patched builds from the vendor address the flaw. Exploitation requires network reachability to the switch's web interface plus valid credentials (PR:L), so exposure is limited to segmented OT/industrial networks where the management UI is reachable; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the high EPSS-relevant characteristics of authenticated command injection in edge/OT devices make prompt patching advisable.
Privileged-mode password recovery affects PLANET IGS-5225-8P2T4S industrial managed switches running V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519, because these devices store administrative credentials using the weak MD5 hashing algorithm. An attacker who obtains the device configuration file - typically via an admin config export, an exposed backup, or physical/local device access - can crack the stored hash offline and recover the privileged-mode password. Exploitation is not remote and requires an authenticated, high-privileged foothold or local access to the config file (CVSS 3.1 AV:L/AC:L/PR:H/UI:N, confidentiality-only impact), and no public exploit has been identified at time of analysis; this is a genuine but low-urgency information-disclosure weakness rather than a critical remotely-reachable flaw.
Stack-based buffer overflow in the web management server of PLANET IGS-5225-8P2T4S industrial managed switches allows a remote authenticated administrator to crash the device or, with carefully crafted input, potentially execute arbitrary code on the underlying operating system. Affected devices run V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519, and exploitation requires valid administrative credentials plus network reachability to the switch's management interface; the high attack complexity means many payloads will only produce a denial of service rather than code execution. No public exploit has been identified at time of analysis, and PLANET has released fixed firmware for both branches.
Stack-based buffer overflow in the web management server of PLANET IGS-5225-8P2T4S industrial managed switches lets an authenticated remote attacker (PR:L) crash the device for a denial of service or, with greater effort, execute arbitrary code on the underlying operating system. Affected are V1 firmware before 1.2412b260707 and V2 firmware before 2.2412b260519; exploitation requires network reachability to the switch web interface, valid credentials, and high attack complexity (AC:H) to achieve reliable code execution, so a straightforward crash/DoS is the more accessible outcome. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis; vendor firmware fixes are available.
Privileged users of PLANET IGS-5225-8P2T4S industrial managed switches running V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519 can activate undocumented debug functionality that ships enabled in the embedded software, reaching an OS command execution path that grants root-level access to the device. Exploitation requires high-privilege administrative/management access and local access to the device management plane (CVSS:4.0 AV:L/PR:H), so the realistic threat is a malicious insider or an attacker who has already obtained management credentials rather than an unauthenticated remote compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor-released patched firmware is available.
OS command injection in the web management server of PLANET IGS-5225-8P2T4S industrial managed switches lets a remote, low-privilege authenticated attacker run arbitrary operating-system commands and obtain root on the device. Only switches running V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519 are affected; patched builds from the vendor address the flaw. Exploitation requires network reachability to the switch's web interface plus valid credentials (PR:L), so exposure is limited to segmented OT/industrial networks where the management UI is reachable; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the high EPSS-relevant characteristics of authenticated command injection in edge/OT devices make prompt patching advisable.
Privileged-mode password recovery affects PLANET IGS-5225-8P2T4S industrial managed switches running V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519, because these devices store administrative credentials using the weak MD5 hashing algorithm. An attacker who obtains the device configuration file - typically via an admin config export, an exposed backup, or physical/local device access - can crack the stored hash offline and recover the privileged-mode password. Exploitation is not remote and requires an authenticated, high-privileged foothold or local access to the config file (CVSS 3.1 AV:L/AC:L/PR:H/UI:N, confidentiality-only impact), and no public exploit has been identified at time of analysis; this is a genuine but low-urgency information-disclosure weakness rather than a critical remotely-reachable flaw.