CVE-2026-75125 Overview
CVE-2026-75125 is an authenticated null pointer dereference vulnerability in the PLANET GS-4210-16P2S V3 managed switch. The flaw resides in the /cgi-bin/dispatcher.cgi endpoint, specifically within the web_poe_alive_rmtip_post handler. The handler dereferences the rmtIP parameter without validating that the parameter exists in the request. A remote authenticated attacker can trigger the condition by omitting rmtIP from a crafted HTTP request. The result is a crash of the CGI process and denial of service of the web management interface. The issue is tracked under CWE-476: NULL Pointer Dereference and is fixed in firmware version 3.441b260626.
Critical Impact
Authenticated attackers can crash the switch web management interface remotely, disrupting administrative access and network operations management.
Affected Products
- PLANET GS-4210-16P2S V3 switch
- Firmware versions before 3.441b260626
- Web management interface (/cgi-bin/dispatcher.cgi)
Discovery Timeline
- 2026-08-28 - CVE-2026-75125 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-75125
Vulnerability Analysis
The vulnerability affects the PoE (Power over Ethernet) alive-check remote IP handler in the switch's web CGI dispatcher. The web_poe_alive_rmtip_post function expects an rmtIP parameter in POST requests to configure the remote IP used for PoE keep-alive checks. The handler retrieves the parameter and passes it to a downstream function without a presence check. When the parameter is absent, the retrieval routine returns a null pointer that is then dereferenced during string processing.
Exploitation requires valid credentials for the web management interface, limiting the attack surface to authenticated sessions. The attacker sends a single crafted POST request that omits the required parameter, causing the dispatcher process to segfault and terminate the web management service.
Root Cause
The root cause is missing input validation in the web_poe_alive_rmtip_post handler within dispatcher.cgi. The code path assumes the rmtIP parameter is always present in incoming requests. No conditional check verifies the return value before the pointer is dereferenced, resulting in the crash described in [CWE-476].
Attack Vector
The attack vector is network-based against the switch web interface. An authenticated user sends a POST request to /cgi-bin/dispatcher.cgi targeting the web_poe_alive_rmtip_post action while omitting the rmtIP field from the request body. The CGI worker dereferences the null pointer and terminates. Repeated requests sustain the denial of service condition against administrators attempting to reach the management interface. See the VulnCheck Advisory for the technical breakdown.
Detection Methods for CVE-2026-75125
Indicators of Compromise
- Unexpected termination or restart of the dispatcher.cgi process on the switch
- Web management interface becoming unresponsive following authenticated HTTP POST requests
- HTTP POST requests to /cgi-bin/dispatcher.cgi targeting web_poe_alive_rmtip_post without an rmtIP parameter
- Repeated authenticated administrative session anomalies preceding management plane outages
Detection Strategies
- Inspect HTTP request logs on the switch and upstream proxies for POST requests to /cgi-bin/dispatcher.cgi referencing the web_poe_alive_rmtip_post action
- Alert on absent or malformed rmtIP parameters in requests to the PoE alive-check endpoint
- Correlate switch management plane availability metrics with authenticated user session activity
Monitoring Recommendations
- Forward switch syslog and web interface access logs to a centralized SIEM for retention and correlation
- Monitor SNMP and ICMP reachability of the management VLAN to identify service disruption early
- Track failed and successful administrative logins to identify potential credential misuse preceding exploitation
How to Mitigate CVE-2026-75125
Immediate Actions Required
- Upgrade PLANET GS-4210-16P2S V3 firmware to version 3.441b260626 or later
- Restrict access to the switch web management interface to trusted management networks only
- Rotate administrative credentials and enforce strong, unique passwords for switch accounts
- Audit account inventory on affected devices and remove unused administrative users
Patch Information
PLANET has released firmware version 3.441b260626 that addresses the null pointer dereference. Refer to the Planet Security Advisory #10 for downloads and installation guidance. Apply the update during a maintenance window and verify management interface functionality after reboot.
Workarounds
- Place the switch management interface on an isolated out-of-band management VLAN reachable only from authorized administrator workstations
- Enforce firewall access control lists that limit HTTP/HTTPS access to the switch to a defined administrator IP allowlist
- Disable the web management interface where CLI or SNMP-based administration is sufficient until the patch is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
