CVE-2026-75123: PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_smtp_test_post
PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with administrator web credentials can send a crafted SMTP server value to execute arbitrary operating-system commands on the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PLANET GS-4210-16P2S firmwareto a version that resolves this vulnerability.Fixed in 3.441b260626 - Compensating control
Because the vulnerability is in authenticated execution via /cgi-bin/dispatcher.cgi (web_smtp_test_post) using a crafted SMTP server value, restrict access to the dispatcher.cgi web_smtp_test_post functionality to trusted administrators (e.g., limit management/web access by network ACL/firewall).
Event History
Frequently Asked Questions
Which systems are affected?
PLANET GS-4210-16P2S devices running firmware earlier than 3.441b260626 are affected.
What access does an attacker need?
An attacker must be able to reach the device's web interface and possess administrator web credentials. No user interaction is required.
What is the impact of successful exploitation?
A successful attacker can execute arbitrary operating-system commands on the affected device, with resulting confidentiality, integrity, and availability impact rated high.