CVE-2026-77217: PLANET GS-4210-16P2S Stack Buffer Overflow and NULL Pointer Dereference via dispatcher.cgi RADIUS Handlers
PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The webradiusSrvpost family of handlers copies the radKey, radKey0, radDftParamKey, radName, and radIp POST parameters into fixed-size stack buffers without length validation, and additionally dereferences radName and radIp without verifying their presence in the request. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PLANET GS-4210-16P2S firmwareto a version that resolves this vulnerability.Fixed in 3.441b260626 - Compensating control
Mitigate denial of service by restricting access to the web management/RADIUS CGI endpoints (e.g., dispatcher.cgi/web_radiusSrv*_post) to trusted IPs only until the fixed firmware is deployed.
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must authenticate to the device's web management interface. The affected code is reachable through RADIUS-related handlers in /cgi-bin/dispatcher.cgi.
What is the practical impact of exploitation?
Crafted POST requests can crash the CGI process or the web management service, causing a denial of service. The provided information does not describe confidentiality or integrity impact.
Which requests trigger the vulnerable behavior?
The affected handlers process the radKey, radKey_0, radDftParamKey, radName, and radIp POST parameters. Oversized values can reach fixed-size stack buffers, while requests omitting radName or radIp can trigger unchecked NULL dereferences.
How can I determine whether my device is affected?
PLANET GS-4210-16P2S devices running firmware earlier than 3.441b260626 are affected. Devices at or beyond that firmware version are not identified as affected in the provided information.