CVE-2026-81946: PLANET IGS-5225 Information Disclosure Flaw

CVE-2026-81946 is an information disclosure vulnerability in PLANET IGS-5225-8P2T4S industrial switches that uses weak MD5 password hashing, allowing attackers to recover privileged passwords. This article covers technical details, affected firmware versions, potential impact, and mitigation strategies.

CVE-2026-81946 Overview

CVE-2026-81946 affects the PLANET IGS-5225-8P2T4S industrial managed switch. The device stores privileged-mode credentials in configuration files using MD5-based password hashing. MD5 is a broken cryptographic algorithm vulnerable to collision and brute-force attacks. An attacker who obtains a device configuration file can recover the privileged-mode access password through offline cracking.

The issue impacts V1 firmware versions before 1.2412b260707 and V2 firmware versions before 2.2412b260519. PLANET Technology has published a security advisory addressing the flaw.

Critical Impact
Attackers with access to a configuration backup can recover the privileged password and gain full administrative control over affected industrial switches.

Affected Products

PLANET IGS-5225-8P2T4S V1 firmware before 1.2412b260707
PLANET IGS-5225-8P2T4S V2 firmware before 2.2412b260519
Industrial managed switch deployments relying on exported configuration backups

Discovery Timeline

2026-09-18 - CVE-2026-81946 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-81946

Vulnerability Analysis

The PLANET IGS-5225-8P2T4S switch protects the privileged-mode access password using the MD5 hash algorithm. MD5 is not a password-hashing function. It executes quickly and lacks the salting and iteration properties required to resist offline attacks. Modern GPU-based cracking rigs can compute billions of MD5 hashes per second.

When an operator exports the device configuration, the file contains the MD5 digest of the privileged password. An attacker who obtains that file can perform dictionary and brute-force attacks offline. Recovery of the cleartext password grants full switch administration privileges, including VLAN reconfiguration, port mirroring, and firmware replacement on the affected industrial network segment.

The advisory is categorized under [CWE-121], though the vulnerability class is more accurately described as use of a broken or risky cryptographic algorithm for credential storage.

Root Cause

The root cause is the use of an unsalted MD5 hash to store the enable password inside device configuration exports. MD5 provides no computational hardness, no per-credential salt, and no iteration count. These properties are required by modern password-storage standards such as bcrypt, scrypt, Argon2, or PBKDF2.

Attack Vector

Exploitation requires local access to a configuration file or an administrative account able to export the running configuration. Attack scenarios include theft of backup archives, access to network management servers, or an insider exporting configurations. Once the file is obtained, the attacker runs an offline cracker such as hashcat or john against the extracted MD5 digest until the plaintext privileged password is recovered.

Refer to the PLANET Security Advisory and the VulnCheck Advisory on Weak Password Hashing for vendor and researcher context.

Detection Methods for CVE-2026-81946

Indicators of Compromise

Unexpected access or download activity targeting switch configuration backup files or TFTP/SFTP repositories.
Unauthorized administrative logins to the IGS-5225-8P2T4S using the enable password from unusual source addresses.
Configuration changes to VLANs, ACLs, or port mirroring made outside of scheduled change windows.

Detection Strategies

Audit access logs on backup servers and network management systems that store PLANET switch configurations.
Correlate SNMP, syslog, and AAA authentication events for repeated or off-hours privileged-mode escalations.
Inspect exported configuration files for MD5-format password entries to confirm exposure prior to patching.

Monitoring Recommendations

Forward switch syslog and authentication events to a centralized SIEM for anomaly correlation.
Alert on configuration export commands and TFTP/SFTP transfers involving network device backups.
Monitor administrative sessions for privilege changes and command execution outside approved baselines.

How to Mitigate CVE-2026-81946

Immediate Actions Required

Upgrade IGS-5225-8P2T4S V1 devices to firmware 1.2412b260707 or later and V2 devices to 2.2412b260519 or later.
Rotate all privileged-mode passwords on affected switches after patching, assuming prior hashes may have been exposed.
Restrict access to configuration backups using strong file-system permissions and encrypted storage.
Review historical backups and treat any previously exported configurations as compromised credential material.

Patch Information

PLANET Technology has released fixed firmware. Apply version 1.2412b260707 for V1 hardware and version 2.2412b260519 for V2 hardware. Follow the vendor guidance in the PLANET Security Advisory for upgrade procedures and verification steps.

Workarounds

Limit configuration export and management-plane access to a hardened jump host with multi-factor authentication.
Store configuration backups in encrypted repositories with strict role-based access controls and audit logging.
Segment switch management interfaces onto an out-of-band VLAN unreachable from user or production networks.
Choose long, high-entropy privileged passwords to slow offline MD5 cracking until firmware upgrades are completed.

bash

# Example: restrict switch management access to an out-of-band subnet
access-list 10 permit 10.250.0.0 0.0.0.255
line vty 0 4
 access-class 10 in
 transport input ssh