CVE-2026-75123: PLANET GS-4210-16P2S Command Injection RCE

CVE-2026-75123 Overview

CVE-2026-75123 is an authenticated operating system command injection vulnerability in PLANET GS-4210-16P2S V3 firmware before 3.441b260626. The flaw resides in /cgi-bin/dispatcher.cgi, where the web_smtp_test_post handler passes a caller-supplied SMTP server value into a shell command without sanitization. An authenticated attacker holding administrator web credentials can inject shell metacharacters into the SMTP server field and execute arbitrary commands on the switch. The weakness is categorized under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact

Successful exploitation grants arbitrary OS command execution on the switch with the privileges of the web management process, enabling full device compromise and pivoting into the managed network.

Affected Products

• PLANET GS-4210-16P2S V3 switch
• Firmware versions prior to 3.441b260626
• Web management interface component /cgi-bin/dispatcher.cgi (web_smtp_test_post handler)

Discovery Timeline

• 2026-08-28 - CVE-2026-75123 published to NVD
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-75123

Vulnerability Analysis

The PLANET GS-4210-16P2S V3 exposes an SMTP test feature through its web administration interface. When an administrator submits the SMTP test form, the request is routed to the web_smtp_test_post handler inside /cgi-bin/dispatcher.cgi. The handler takes the SMTP server value directly from the HTTP request and concatenates it into a shell command line invoked by the CGI process. Because the input is neither escaped nor validated against a strict allow-list, shell metacharacters such as ;, |, &, and backticks are interpreted by the underlying shell. An authenticated attacker can therefore run arbitrary binaries available on the switch, including BusyBox utilities, and read or modify device state. The vulnerability requires valid administrator credentials, but network switches in production frequently share credentials across fleets or expose management interfaces to internal networks, expanding the practical attack surface.

Root Cause

The root cause is missing input neutralization on a user-controlled string that flows into an OS command. The web_smtp_test_post handler builds the SMTP test command through string concatenation instead of using a safe parameterized invocation or a strict allow-list for hostnames and IP addresses. This is a textbook [CWE-78] pattern in embedded CGI code.

Attack Vector

An attacker authenticates to the switch web interface as an administrator. The attacker then submits a crafted SMTP test request to /cgi-bin/dispatcher.cgi in which the SMTP server field contains shell metacharacters followed by an arbitrary command. The CGI handler passes the composite string to the shell, which executes the injected command. Because the CGI runs with elevated privileges on the embedded Linux system, the injected command inherits broad file system and network access.

No verified proof-of-concept code has been published. See the VulnCheck Planet GS-4210 Command Injection Advisory and the Planet Security Advisory #10 for technical context.

Detection Methods for CVE-2026-75123

Indicators of Compromise

• HTTP POST requests to /cgi-bin/dispatcher.cgi invoking the web_smtp_test_post action with shell metacharacters (;, |, &, `, $() in the SMTP server parameter.
• Outbound network connections from the switch management IP to unexpected destinations shortly after SMTP test activity.
• Unexpected new processes, cron entries, or modified startup scripts on the switch, if shell access is available for forensic review.
• Administrator logins to the switch web UI from unusual source addresses or at unusual times preceding SMTP test requests.

Detection Strategies

• Inspect web access logs and any upstream reverse proxy or WAF logs for requests to dispatcher.cgi containing SMTP-related parameters combined with command-injection characters.
• Correlate administrative authentication events with subsequent SMTP test submissions to identify anomalous configuration activity.
• Baseline outbound traffic from switch management interfaces and alert on deviations, since a compromised switch typically initiates uncharacteristic egress.

Monitoring Recommendations

• Forward switch syslog and web management logs to a centralized log platform and retain them long enough to support retrospective hunts.
• Monitor management VLANs with network detection tooling and alert on non-standard protocols originating from switch IPs.
• Track firmware version inventory continuously and alert when devices remain on versions earlier than 3.441b260626.

How to Mitigate CVE-2026-75123

Immediate Actions Required

• Upgrade affected GS-4210-16P2S V3 units to firmware 3.441b260626 or later as published in the Planet Security Advisory #10.
• Restrict access to the switch web management interface to a dedicated management VLAN reachable only from trusted administrator workstations.
• Rotate administrator credentials on all affected devices and remove any shared or default accounts.
• Audit recent web management logs for suspicious dispatcher.cgi activity and evidence of command injection attempts.

Patch Information

PLANET has released firmware version 3.441b260626 addressing the command injection in the web_smtp_test_post handler. Refer to the Planet Security Advisory #10 for the fixed firmware download and release notes. Confirm the running firmware version through the switch web UI or CLI after upgrade.

Workarounds

• Block administrative access to /cgi-bin/dispatcher.cgi from untrusted networks using upstream access-control lists or firewall rules.
• Disable or avoid using the SMTP test feature until the firmware upgrade is completed.
• Enforce multi-factor administrative workflows, such as jump hosts with session recording, for any account with switch web credentials.

# Example ACL restricting switch web management to a jump host
# Applied on the upstream L3 device
access-list MGMT_SWITCH permit tcp host 10.10.0.25 host 10.20.0.1 eq 443
access-list MGMT_SWITCH deny   tcp any host 10.20.0.1 eq 443
access-list MGMT_SWITCH permit ip any any