CVE-2026-75124 Overview
CVE-2026-75124 is a pre-authentication memory corruption vulnerability in the PLANET GS-4210-16P2S V3 managed switch. The flaw resides in the web management interface, specifically the _readHttpParam function, which copies an oversized HTTP query string into a fixed-size stack buffer without guaranteeing NUL termination. The downstream parse_query_string routine then processes attacker-controlled data, corrupting stack memory. An unauthenticated remote attacker can send a crafted GET request to dispatcher.cgi and disrupt the web management interface. The issue is tracked under [CWE-120] (classic buffer copy without checking size of input) and affects firmware versions prior to 3.441b260626.
Critical Impact
Unauthenticated remote attackers can trigger denial of service of the switch management interface and potentially achieve memory corruption on the device.
Affected Products
- PLANET GS-4210-16P2S V3 switch
- Firmware versions before 3.441b260626
- Web management interface (dispatcher.cgi)
Discovery Timeline
- 2026-08-28 - CVE-2026-75124 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-75124
Vulnerability Analysis
The vulnerability exists in the HTTP parameter handling logic of the PLANET GS-4210-16P2S V3 web management interface. The _readHttpParam function reads the HTTP query string from a client request and copies it into a fixed-size stack buffer. The copy operation does not enforce a size boundary and does not guarantee NUL termination of the destination buffer. When parse_query_string subsequently iterates the buffer to extract key-value pairs, it walks past the intended buffer boundary. This corrupts adjacent stack memory, including saved registers and the return address.
Because the vulnerable code path executes before any authentication check, exploitation requires only network reachability to the management interface. Successful exploitation halts the web server on the switch and denies administrative access. Depending on the layout of the corrupted stack frame, an attacker may be able to influence control flow.
Root Cause
The root cause is a classic buffer copy without input length validation, mapped to [CWE-120]. The _readHttpParam function trusts the length of the inbound HTTP query string and lacks bounds checks against the fixed-size destination buffer. The absence of forced NUL termination further guarantees that string-parsing routines read beyond the buffer.
Attack Vector
Exploitation occurs over the network against the switch web management interface. An attacker sends an HTTP GET request to dispatcher.cgi containing an oversized query string. No credentials, user interaction, or prior foothold are required. The vulnerability description in the VulnCheck Advisory for Memory Corruption documents the request path and function behavior. No public proof-of-concept exploit is currently listed for this CVE.
Detection Methods for CVE-2026-75124
Indicators of Compromise
- Unexpected restarts or hangs of the switch web management daemon following inbound HTTP traffic
- Loss of administrative access to the switch web UI while data-plane forwarding continues
- HTTP GET requests to dispatcher.cgi with abnormally long query strings from untrusted sources
- Repeated connections to the management VLAN from external or non-administrative networks
Detection Strategies
- Inspect web server access logs on the switch, where available, for GET requests to dispatcher.cgi with query string lengths exceeding typical administrative usage.
- Deploy network intrusion detection signatures that flag HTTP requests to switch management endpoints containing oversized query parameters.
- Correlate switch management-plane availability metrics with inbound HTTP traffic patterns to identify DoS attempts.
Monitoring Recommendations
- Monitor SNMP and syslog output from the switch for web service crashes or watchdog resets.
- Alert on any HTTP traffic to switch management IPs originating from outside the designated management network.
- Track firmware version inventory across PLANET switches to confirm remediation status.
How to Mitigate CVE-2026-75124
Immediate Actions Required
- Upgrade PLANET GS-4210-16P2S V3 firmware to version 3.441b260626 or later as directed in the Planet Security Advisory #10.
- Restrict access to the switch web management interface to a dedicated management VLAN and known administrator IP addresses.
- Disable the web management interface if configuration is performed via CLI or SNMP only.
- Audit exposure by scanning perimeter networks for reachable PLANET switch management interfaces.
Patch Information
PLANET has released firmware 3.441b260626 addressing the buffer copy behavior in _readHttpParam. Apply the vendor firmware update from the Planet Security Advisory #10. Verify firmware integrity and reboot the switch after applying the update.
Workarounds
- Place switch management interfaces behind an ACL that permits HTTP/HTTPS only from trusted administrative subnets.
- Block inbound traffic to dispatcher.cgi at upstream firewalls until the firmware update is applied.
- Use out-of-band management, such as the serial console or SSH CLI, to administer affected switches while the web UI remains exposed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
