Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-75124— PLANET GS-4210-16P2S V3 Memory Corruption via dispatcher.cgi _readHttpParam

Quick assessment

Affected

PLANET Technology Corp. PLANET GS-4210-16P2S V3

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PLANET GS-4210-16P2S是中国Planet公司的一款网管型以太网交换机。 PLANET GS-4210-16P2S 3.441b260626之前版本存在缓冲区错误漏洞，该漏洞源于_readHttpParam函数复制超大HTTP查询字符串时未保证NUL终止，导致parse_query_string处理攻击者控制的数据到固定大小栈缓冲区，可能导致拒绝服务和内存损坏。

CVSS 7.5 · High EPSS 0.71% · P53 Updated Sep 02, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
PLANET Technology Corp.	PLANET GS-4210-16P2S V3	`< 3.441b260626`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75124

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

PLANET GS-4210-16P2S V3 Memory Corruption via dispatcher.cgi _readHttpParam

Source: CVE Program / CVE List V5

Vulnerability Description

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to dispatcher.cgi to cause denial of service of the web management interface and potentially trigger memory corruption.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出)

Source: CVE Program / CVE List V5

Vulnerability Title

PLANET GS-4210-16P2S 缓冲区错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
PLANET Technology Corp.	PLANET GS-4210-16P2S V3	0 ~ 3.441b260626	-

II. Public POCs for CVE-2026-75124

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-75124

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-75124 (2)

🔗 PLANET GS-4210-16P2S Memory Corruption via dispatcher.cgi _readHttpParam | Advisories | VulnCheck third-party-advisory
🔗 PLANET GS-4210-16P2S V3 - Security Advisory - PLANET Technology Read full article vendor-advisory patch

https://www.cve.org/CVERecord?id=CVE-2026-75124

Same Patch Batch · PLANET Technology Corp. · 2026-08-28 · 8 CVEs total

CVE-2026-75121	7.2 HIGH	PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_vlan_membership_edit_dial
CVE-2026-75122	7.2 HIGH	PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgi
CVE-2026-75123	7.2 HIGH	PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post
CVE-2026-75126	4.9 MEDIUM	PLANET GS-4210-16P2S V3 Stack Buffer Overflow via dispatcher.cgi Standard Handlers
CVE-2026-75125	4.9 MEDIUM	PLANET GS-4210-16P2S V3 Null Pointer Dereference DoS via dispatcher.cgi web_poe_alive_rmti
CVE-2026-77217	4.9 MEDIUM	PLANET GS-4210-16P2S V3 Stack Buffer Overflow and NULL Pointer Dereference via dispatcher.
CVE-2026-77218	4.9 MEDIUM	PLANET GS-4210-16P2S V3 Stack Buffer Overflow via dispatcher.cgi Credential Handlers

IV. Related Vulnerabilities

Same product: PLANET GS-4210-16P2S V3

Same vendor: PLANET Technology Corp.

Same weakness: CWE-120