CVE-2026-77217: PLANET GS-4210-16P2S DoS Vulnerability

CVE-2026-77217 Overview

CVE-2026-77217 affects PLANET GS-4210-16P2S V3 switches running firmware before 3.441b260626. The flaw exists in /cgi-bin/dispatcher.cgi, specifically in the web_radiusSrv*_post family of handlers. These handlers copy the radKey, radKey_0, radDftParamKey, radName, and radIp POST parameters into fixed-size stack buffers without length validation. The same handlers dereference radName and radIp without verifying that the parameters exist in the request. An authenticated remote attacker can send crafted requests to trigger a stack buffer overflow [CWE-121] or a null pointer dereference, crashing the CGI process or the web management service.

Critical Impact
Authenticated attackers can crash the web management service on affected PLANET GS-4210-16P2S V3 switches, disrupting device administration.

Affected Products

PLANET GS-4210-16P2S V3 switch
Firmware versions prior to 3.441b260626
Web management interface exposed via /cgi-bin/dispatcher.cgi

Discovery Timeline

2026-08-28 - CVE-2026-77217 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-77217

Vulnerability Analysis

The vulnerability resides in the RADIUS server configuration handlers within dispatcher.cgi on the switch's web management interface. The web_radiusSrv*_post handler family accepts POST parameters used to configure RADIUS authentication settings. These parameters are copied directly into fixed-size stack buffers without bounds checking, producing a classic stack buffer overflow condition [CWE-121]. The same handlers also access radName and radIp without first confirming those fields are present in the incoming request, which yields a null pointer dereference when either parameter is omitted.

Exploitation requires an authenticated session against the switch's management interface. A successful request either overwrites adjacent stack memory or forces a null dereference, both of which crash the CGI worker and, in some paths, the web management service itself. This produces a denial-of-service condition against the administrative plane of the switch.

Root Cause

The root cause is missing input validation in the RADIUS configuration POST handlers. The code performs unbounded copy operations from attacker-controlled request parameters into fixed-size stack buffers and omits presence checks for required fields before dereferencing them.

Attack Vector

The attack vector is network-based and requires high privileges: an attacker must first authenticate to the web management interface. From there, the attacker sends a crafted HTTP POST request to /cgi-bin/dispatcher.cgi targeting one of the web_radiusSrv*_post handlers, either supplying oversized values for radKey, radKey_0, radDftParamKey, radName, or radIp, or omitting radName or radIp entirely. Verified code examples are not available. Refer to the VulnCheck Advisory on Planet GS-4210 for technical detail.

Detection Methods for CVE-2026-77217

Indicators of Compromise

Unexpected restarts or crashes of the dispatcher.cgi process or the switch's web management service.
HTTP POST requests to /cgi-bin/dispatcher.cgi containing abnormally long radKey, radKey_0, radDftParamKey, radName, or radIp values.
Authenticated administrative sessions from unexpected source addresses immediately preceding management-plane outages.

Detection Strategies

Inspect HTTP request logs on the switch and any upstream reverse proxy for POST bodies to dispatcher.cgi with parameter values exceeding typical RADIUS field lengths.
Alert on repeated 5xx responses or connection resets from the switch management interface following POST activity to RADIUS configuration endpoints.
Correlate administrator login events with subsequent management-plane crashes to identify abuse of legitimate credentials.

Monitoring Recommendations

Forward switch syslog and web-server logs to a centralized logging platform for retention and query.
Monitor availability of the switch management interface using synthetic health checks so crashes are surfaced quickly.
Track configuration changes to RADIUS server entries and flag anomalous parameter payloads for review.

How to Mitigate CVE-2026-77217

Immediate Actions Required

Upgrade GS-4210-16P2S V3 firmware to version 3.441b260626 or later as published in the Planet Security Advisory.
Restrict access to the switch management interface to a dedicated management VLAN or jump host.
Rotate administrator credentials and review accounts with access to the web management interface.

Patch Information

PLANET has released firmware version 3.441b260626, which addresses the stack buffer overflow and null pointer dereference conditions in the web_radiusSrv*_post handlers. Details are available in the Planet Security Advisory and the VulnCheck Advisory on Planet GS-4210.

Workarounds

Disable the web management interface where the switch can be administered via console or SSH.
Enforce ACLs on the management VLAN so only trusted administrative hosts can reach /cgi-bin/dispatcher.cgi.
Limit administrative accounts to the minimum required and audit login events on the switch.

bash

# Example: restrict management access at an upstream firewall
# Allow only the management subnet to reach the switch web UI
iptables -A FORWARD -s 10.10.0.0/24 -d <switch-ip> -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d <switch-ip> -p tcp --dport 443 -j DROP