CVE-2026-75122 Overview
CVE-2026-75122 is an authenticated operating system command injection vulnerability in the PLANET GS-4210-16P2S V3 managed switch. Firmware versions before 3.441b260626 fail to sanitize shell metacharacters in the certificate password field of the /cgi-bin/httpuploadcert.cgi endpoint. An authenticated administrator can submit a crafted certificate upload request to run arbitrary commands on the underlying operating system. The flaw is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
Critical Impact
A remote attacker with valid administrator web credentials can achieve arbitrary OS command execution on the switch, gaining full control over network infrastructure and traffic passing through the device.
Affected Products
- PLANET GS-4210-16P2S V3 managed switch
- Firmware versions prior to 3.441b260626
- The /cgi-bin/httpuploadcert.cgi certificate upload handler
Discovery Timeline
- 2026-08-28 - CVE-2026-75122 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-75122
Vulnerability Analysis
The vulnerability resides in the certificate upload handler exposed at /cgi-bin/httpuploadcert.cgi on the switch's web management interface. The handler accepts a certificate password field as part of the upload request. That value is concatenated directly into a shell command string and passed to a system shell without escaping or filtering shell metacharacters.
Because the underlying invocation performs no input neutralization, characters such as `, $(), ;, &&, |, and newline can terminate the intended command and inject attacker-controlled operands. The injected commands execute in the context of the process handling the CGI request, which on embedded network devices typically runs with elevated privileges.
Exploitation requires authentication as an administrator, which limits opportunistic attacks. However, administrator credentials are frequently reused, exposed through phishing, or left at vendor defaults on operational technology and small-business networks. The impact spans confidentiality, integrity, and availability of the device itself, per the CVSS 4.0 vector.
Root Cause
The root cause is missing input sanitization in the certificate upload CGI. The password field is treated as trusted string data and interpolated into an OS command rather than being passed as an isolated argument or validated against an allowlist. This is a textbook CWE-78 defect in an embedded management plane.
Attack Vector
An attacker authenticates to the web UI using valid administrator credentials. They then issue a crafted HTTP POST request to /cgi-bin/httpuploadcert.cgi in which the certificate password field contains shell metacharacters and an injected command. The switch executes the injected payload with the privileges of the CGI process. See the VulnCheck Advisory for Command Injection for endpoint-specific details.
No verified public proof-of-concept code is available. The mechanism is described in prose above; refer to the Planet Security Advisory for vendor guidance.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-75122
Indicators of Compromise
- HTTP POST requests to /cgi-bin/httpuploadcert.cgi containing shell metacharacters such as `, $(, ;, |, or && inside the certificate password parameter.
- Unexpected child processes spawned by the web server or CGI process on the switch, including shells or network utilities.
- Outbound connections initiated by the switch to unfamiliar hosts shortly after a certificate upload event.
Detection Strategies
- Inspect management-plane HTTP traffic at network chokepoints for POST requests to the vulnerable CGI endpoint, and alert when parameter values contain command-injection tokens.
- Correlate administrator logins on the switch with subsequent certificate upload activity, especially from unusual source addresses or off-hours sessions.
- Ingest switch syslog into a SIEM or data lake and hunt for authentication anomalies combined with configuration change events on the affected model.
Monitoring Recommendations
- Restrict management interface exposure and monitor any access attempts from outside the management VLAN.
- Track firmware version inventory and alert when GS-4210-16P2S V3 devices report versions older than 3.441b260626.
- Monitor for administrator password reuse or credential exposure that could be leveraged to reach the authenticated attack surface.
How to Mitigate CVE-2026-75122
Immediate Actions Required
- Upgrade PLANET GS-4210-16P2S V3 firmware to version 3.441b260626 or later as specified in the Planet Security Advisory.
- Rotate administrator credentials on all affected switches and remove any default or shared accounts.
- Confine the switch web management interface to a dedicated management network, blocking access from user, guest, and internet-facing segments.
Patch Information
PLANET has released firmware version 3.441b260626 that addresses the input sanitization defect in /cgi-bin/httpuploadcert.cgi. Download and installation instructions are available in the Planet Security Advisory. Additional technical context is documented in the VulnCheck Advisory for Command Injection.
Workarounds
- Disable the HTTP/HTTPS web management interface where CLI or out-of-band management is available until patching is completed.
- Enforce access control lists on the switch to permit management connections only from a small set of trusted administrator workstations.
- Require multi-factor authentication on jump hosts used to reach switch management interfaces, reducing the value of stolen administrator passwords.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
