CVE-2026-75121 Overview
CVE-2026-75121 is an authenticated OS command injection vulnerability in the PLANET GS-4210-16P2S V3 managed switch. The flaw resides in /cgi-bin/dispatcher.cgi, specifically the web_vlan_membership_edit_dialog_post handler. The handler passes the memberTags POST parameter directly into a shell command without sanitization. An authenticated remote attacker can inject arbitrary operating-system commands and execute them on the underlying device.
The vulnerability affects PLANET GS-4210-16P2S V3 firmware versions prior to 3.441b260626. It is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Critical Impact
A remote authenticated attacker can execute arbitrary OS commands on the switch, resulting in full compromise of network infrastructure equipment.
Affected Products
- PLANET GS-4210-16P2S V3 managed switch
- Firmware versions before 3.441b260626
- Web management interface component /cgi-bin/dispatcher.cgi
Discovery Timeline
- 2026-08-28 - CVE-2026-75121 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-75121
Vulnerability Analysis
The PLANET GS-4210-16P2S V3 switch exposes a web management interface backed by dispatcher.cgi. The web_vlan_membership_edit_dialog_post handler processes VLAN membership edits submitted via HTTP POST. During processing, the handler reads the memberTags POST parameter and concatenates it into a shell command string. The application then invokes a system shell to execute the resulting command.
Because the handler does not validate, escape, or neutralize shell metacharacters in memberTags, an attacker can embed characters such as ;, |, &, or backticks. Those characters break out of the intended command context and introduce attacker-controlled commands. Execution occurs with the privileges of the CGI process, which on embedded switches typically runs as root.
Exploitation requires valid authentication to the switch web interface. However, network administrators often reuse credentials across managed devices, and default credentials on switches are a common weakness.
Root Cause
The root cause is unsanitized inclusion of user-supplied input in an OS command string, a classic [CWE-78] pattern. The memberTags parameter is trusted as a VLAN identifier list but is passed to a shell without validation against an allow-list of numeric values.
Attack Vector
The attack requires network access to the switch management interface and valid credentials. The attacker sends a crafted HTTP POST request to /cgi-bin/dispatcher.cgi invoking the web_vlan_membership_edit_dialog_post handler. The memberTags field carries the injected shell payload. Refer to the VulnCheck advisory for CVE-2026-75121 for further technical detail.
Detection Methods for CVE-2026-75121
Indicators of Compromise
- POST requests to /cgi-bin/dispatcher.cgi containing shell metacharacters (;, |, `, $() in the memberTags parameter.
- Unexpected outbound connections originating from the switch management IP address.
- Configuration changes, new user accounts, or firmware modifications on the switch that were not initiated by administrators.
Detection Strategies
- Inspect web-server and reverse-proxy logs for POST bodies to dispatcher.cgi referencing web_vlan_membership_edit_dialog_post with non-numeric memberTags values.
- Deploy network intrusion detection signatures that flag shell metacharacters in HTTP POST parameters destined for switch management interfaces.
- Correlate authentication events on the switch with subsequent configuration changes to identify anomalous administrative activity.
Monitoring Recommendations
- Restrict switch management interfaces to a dedicated out-of-band management VLAN and log all access.
- Forward switch syslog and authentication events to a central SIEM for correlation and retention.
- Alert on repeated authentication failures against switch web interfaces, which often precede credential-based exploitation.
How to Mitigate CVE-2026-75121
Immediate Actions Required
- Upgrade PLANET GS-4210-16P2S V3 firmware to version 3.441b260626 or later, as described in the Planet Security Advisory #10.
- Rotate all administrative credentials on affected switches and remove any unused accounts.
- Audit switch configurations for unauthorized changes since the earliest possible exposure window.
Patch Information
PLANET has released fixed firmware version 3.441b260626 that addresses the command injection in the web_vlan_membership_edit_dialog_post handler. Download the update from the Planet Security Advisory #10 page and follow the vendor upgrade procedure.
Workarounds
- Block access to the switch web management interface from all networks except a dedicated management subnet using firewall or ACL rules.
- Disable the HTTP/HTTPS management service on the switch when not actively required and use console or SSH-based management instead.
- Enforce strong, unique credentials for every administrative account and require multi-factor authentication at the jump host used to reach the management interface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.