CVE-2026-75121: PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post
PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated attacker can send a crafted memberTags value to execute arbitrary operating-system commands on the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PLANET GS-4210-16P2S firmwareto a version that resolves this vulnerability.Fixed in 3.441b260626
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must authenticate to the device and be able to submit requests to the web_vlan_membership_edit_dialog_post handler. The attack does not require user interaction.
Which firmware versions are affected?
Firmware versions before 3.441b260626 are affected. The provided data does not identify whether any specific default credentials or default deployment configuration would enable exploitation.
What access does successful exploitation provide?
Successful exploitation allows arbitrary operating-system command execution on the device through a crafted memberTags POST parameter. This can affect confidentiality, integrity, and availability.