CVE-2026-77217: PLANET GS-4210-16P2S V3 Stack Buffer Overflow and NULL Pointer Dereference via dispatcher.cgi RADIUS Handlers
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The webradiusSrvpost family of handlers copies the radKey, radKey0, radDftParamKey, radName, and radIp POST parameters into fixed-size stack buffers without length validation, and additionally dereferences radName and radIp without verifying their presence in the request. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PLANET GS-4210-16P2S V3 firmware (/cgi-bin/dispatcher.cgi)to a version that resolves this vulnerability.Fixed in 3.441b260626 - Compensating control
If immediate firmware upgrade is not possible, restrict access to the web management service and/or dispatcher.cgi (e.g., limit reachability of the CGI endpoint and the RADIUS-related dispatcher.cgi requests to trusted admin networks/IPs).
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must authenticate to the device's web management interface. The affected code is reachable through RADIUS-related handlers in /cgi-bin/dispatcher.cgi.
What is the practical impact of exploitation?
Crafted POST requests can crash the CGI process or the web management service, causing a denial of service. The provided information does not describe confidentiality or integrity impact.
Which requests trigger the vulnerable behavior?
The affected handlers process the radKey, radKey_0, radDftParamKey, radName, and radIp POST parameters. Oversized values can reach fixed-size stack buffers, while requests omitting radName or radIp can trigger unchecked NULL dereferences.
How can I determine whether my device is affected?
PLANET GS-4210-16P2S devices running firmware earlier than 3.441b260626 are affected. Devices at or beyond that firmware version are not identified as affected in the provided information.