PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A remote attacker with administrator web credentials can submit a crafted certificate upload request to execute arbitrary operating-system commands on the device.

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with administrator web credentials can send a crafted SMTP server value to execute arbitrary operating-system commands on the device.

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated attacker can send a crafted memberTags value to execute arbitrary operating-system commands on the device.

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parsequerystring to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to dispatcher.cgi to cause denial of service of the web management interface and potentially trigger memory corruption.

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy attacker-controlled POST parameters into fixed-size stack buffers without length validation: webvlanmembershipeditdialogpost; webdaivlanpost; webpoealivermtippost; websyssntppost; webtoolupgradeManagerpost; webportcountersClrpost; webrmonstatisticsClrpost; webcablediagcopperpost; webaaaAuthlist handlers; webaclmgmtRulesApplypost; webaclmgmtRulesEditpost; webaclAceDelpost handlers; webaclAceAdd/Editpost handlers; webaclbindAddpost; webaclbindEditpost; websnmpv3viewaddpost; websnmpv3groupaddpost; websnmpv3communityaddpost; websnmpv3hostaddpost; websnmpnotifyv3addpost; websnmpv3useraddpost; websnmpv3remoteengineIdaddpost; webstpglobalSettingpost; webisgdbpost; webtacpluspost handlers; webdhcpoption82post; and webdhcpportoption82cidpost. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service.

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The webradiusSrvpost family of handlers copies the radKey, radKey0, radDftParamKey, radName, and radIp POST parameters into fixed-size stack buffers without length validation, and additionally dereferences radName and radIp without verifying their presence in the request. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service.