CVE-2026-75126 Overview
CVE-2026-75126 affects the PLANET GS-4210-16P2S V3 managed switch firmware prior to version 3.441b260626. The vulnerability consists of multiple authenticated stack buffer overflows in /cgi-bin/dispatcher.cgi. Numerous POST handlers copy attacker-controlled parameters into fixed-size stack buffers without validating length. An authenticated remote attacker can send crafted HTTP requests to crash the CGI process or the web management service, producing a denial of service on the switch management plane. The issue is tracked under CWE-121 (Stack-based Buffer Overflow).
Critical Impact
An authenticated remote attacker can crash the web management interface of the PLANET GS-4210-16P2S V3 switch, disrupting device administration and monitoring.
Affected Products
- PLANET GS-4210-16P2S V3 switch firmware prior to 3.441b260626
- /cgi-bin/dispatcher.cgi web management endpoint
- Web-based administration service on the affected firmware builds
Discovery Timeline
- 2026-08-28 - CVE-2026-75126 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-75126
Vulnerability Analysis
The PLANET GS-4210-16P2S V3 exposes a web management interface backed by dispatcher.cgi. This CGI multiplexes POST requests to dedicated C handler functions. Multiple handlers copy user-supplied POST parameters into fixed-size stack buffers using unbounded copy operations. When an attacker submits a parameter longer than the destination buffer, the copy corrupts the saved return address and adjacent stack frame data.
The affected handler set spans core administrative surfaces: VLAN membership editing (web_vlan_membership_edit_dialog_post), Dynamic ARP Inspection (web_dai_vlan_post), Power-over-Ethernet keepalive (web_poe_alive_rmtip_post), SNTP time sync (web_sys_sntp_post), firmware upgrade management (web_tool_upgradeManager_post), counters and RMON statistics clearing, cable diagnostics, AAA authentication lists, ACL rule and binding management, SNMPv3 view/group/community/host/user/notify/engineId configuration, STP, ISG, TACACS+, and DHCP Option 82 configuration.
Exploitation crashes the CGI process and, in many cases, the parent web server, taking the management plane offline until the device restarts the service or reboots. Data-plane traffic is not directly impacted, but loss of administrative access blocks configuration changes and monitoring.
Root Cause
The root cause is missing length validation before copying HTTP POST parameters into fixed-size stack buffers, classified as [CWE-121]. The handlers rely on unbounded string operations rather than length-checked equivalents. Any handler that trusts POST parameter length becomes a viable overflow site.
Attack Vector
The attacker must first authenticate to the web management interface. Once authenticated, the attacker sends a POST request to /cgi-bin/dispatcher.cgi targeting one of the vulnerable handlers with an oversized parameter value. The oversized value corrupts the stack and terminates the CGI process, resulting in denial of service. No user interaction beyond the attacker's own request is required.
See the VulnCheck Advisory on Stack Overflow for handler-level technical detail.
Detection Methods for CVE-2026-75126
Indicators of Compromise
- Unexpected termination or restart of dispatcher.cgi or the embedded web server on the GS-4210-16P2S V3
- HTTP 5xx responses or dropped connections to /cgi-bin/dispatcher.cgi following authenticated POST requests with abnormally long parameter values
- Repeated authenticated POST requests to handlers such as web_snmp_v3user_add_post, web_acl_mgmt_Rules_Edit_post, or web_tool_upgradeManager_post from a single source
Detection Strategies
- Inspect web management logs and reverse-proxy access logs for POST requests to /cgi-bin/dispatcher.cgi with content lengths exceeding expected field sizes
- Alert on management-plane availability loss correlated with recent authenticated web sessions
- Baseline normal administrator request patterns and flag high request rates to a single dispatcher handler
Monitoring Recommendations
- Forward switch syslog, HTTP access, and authentication events to a centralized logging platform for correlation
- Monitor SNMP sysUpTime and web service reachability to detect service restarts triggered by exploitation
- Track administrative login sources and flag logins from networks that should not reach the management VLAN
How to Mitigate CVE-2026-75126
Immediate Actions Required
- Upgrade PLANET GS-4210-16P2S V3 firmware to version 3.441b260626 or later
- Restrict access to /cgi-bin/dispatcher.cgi and the web management interface to a dedicated management VLAN or jump host
- Rotate administrator credentials and disable unused accounts on the switch
- Enforce strong, unique passwords to raise the bar for the authenticated precondition
Patch Information
PLANET has released firmware version 3.441b260626 that remediates the affected handlers. Review the Planet Security Advisory for the official fixed build and upgrade instructions. Apply the update during a planned maintenance window because the web service will restart.
Workarounds
- Place the switch management interface behind an access control list that permits only trusted administrator source addresses
- Disable the HTTP/HTTPS management service on interfaces exposed to untrusted networks and manage the device via console or an isolated out-of-band network
- Terminate idle administrator sessions promptly and audit account activity until the firmware update is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
