CVE-2026-77218 Overview
CVE-2026-77218 affects PLANET GS-4210-16P2S V3 switches running firmware versions prior to 3.441b260626. The vulnerability consists of authenticated stack buffer overflow flaws in /cgi-bin/dispatcher.cgi. Three request handlers copy user-supplied POST parameters into fixed-size stack buffers without length validation. An authenticated remote attacker can send a crafted request to crash the CGI process or web management service. The flaws are classified under CWE-121: Stack-based Buffer Overflow.
Critical Impact
Authenticated attackers can trigger denial of service against the switch management interface by sending oversized usrPass, enbPass, or usrName POST parameters to dispatcher.cgi.
Affected Products
- PLANET GS-4210-16P2S V3 switch
- Firmware versions before 3.441b260626
- Web management service (/cgi-bin/dispatcher.cgi)
Discovery Timeline
- 2026-08-28 - CVE-2026-77218 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-77218
Vulnerability Analysis
The PLANET GS-4210-16P2S V3 web management interface exposes /cgi-bin/dispatcher.cgi for configuration operations. Three handlers within this CGI binary contain stack-based buffer overflows. The web_login_first_post handler processes the usrPass POST parameter during initial login flow. The web_sys_enablePasswd_post handler processes the enbPass parameter used for enable-password configuration. The web_sys_localUser_post handler processes both usrName and usrPass parameters during local user creation. Each handler copies attacker-controlled data into fixed-size stack buffers without bounds checking.
Root Cause
The root cause is missing length validation before copying POST parameter values into stack buffers. The CGI code uses unsafe string-copy operations against fixed-size destination buffers. When a submitted parameter exceeds the buffer size, adjacent stack memory is overwritten. This corrupts saved return addresses and stack canaries, causing the CGI worker or the web management service to abort. The pattern falls under CWE-121: Stack-based Buffer Overflow.
Attack Vector
An attacker must first authenticate to the switch management interface. The attacker then issues an HTTP POST to /cgi-bin/dispatcher.cgi targeting one of the affected handlers. The request includes an oversized value for usrPass, enbPass, or usrName. Processing the request overflows the stack buffer and terminates the CGI process or the web service. Recovery may require a service restart or device reboot, blocking legitimate administrative access during the outage. The current advisory scope documents denial of service impact; code execution is not confirmed.
See the Planet Security Advisory #10 and the VulnCheck Advisory for Planet GS-4210 for handler-level technical details.
Detection Methods for CVE-2026-77218
Indicators of Compromise
- Unexpected restarts of the switch web management service or dispatcher.cgi worker processes.
- HTTP POST requests to /cgi-bin/dispatcher.cgi containing abnormally long usrPass, enbPass, or usrName field values.
- Authenticated administrative sessions originating from unusual source addresses immediately before a management-plane outage.
Detection Strategies
- Inspect network traffic to the switch management VLAN for POST bodies to dispatcher.cgi where parameter lengths exceed reasonable credential sizes.
- Correlate switch SNMP or syslog messages indicating web service restarts with prior HTTP requests to the CGI endpoint.
- Alert on repeated authenticated requests to web_login_first_post, web_sys_enablePasswd_post, or web_sys_localUser_post from a single source within a short window.
Monitoring Recommendations
- Forward switch syslog output to a centralized log platform and monitor for CGI crash and service-restart events.
- Track admin authentication events on GS-4210-16P2S devices and flag sessions followed by management-plane unavailability.
- Baseline expected request sizes to /cgi-bin/dispatcher.cgi and alert on deviations.
How to Mitigate CVE-2026-77218
Immediate Actions Required
- Upgrade GS-4210-16P2S V3 firmware to version 3.441b260626 or later as published in the Planet Security Advisory #10.
- Restrict access to the switch web management interface to a dedicated management network or trusted jump hosts.
- Rotate administrative credentials on affected switches and remove unused local accounts.
- Audit existing admin accounts for unexpected additions that could be leveraged to reach the vulnerable handlers.
Patch Information
PLANET has released firmware 3.441b260626 that addresses the three affected handlers in /cgi-bin/dispatcher.cgi. Refer to the Planet Security Advisory #10 for firmware download links and installation instructions specific to the GS-4210-16P2S V3 model. The VulnCheck Advisory for Planet GS-4210 documents the handler names and affected parameters.
Workarounds
- Disable the HTTP/HTTPS web management interface where CLI or out-of-band management is available.
- Place switches behind an access control list that permits management traffic only from authorized administrator hosts.
- Enforce least-privilege on local switch accounts to reduce the number of users who can reach the vulnerable authenticated handlers.
- Monitor and rate-limit requests to /cgi-bin/dispatcher.cgi at an upstream inline device where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
