Description

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_vlan_membership_edit_dialog_post handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated attacker can send a crafted memberTags value to execute arbitrary operating-system commands on the device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-28T20:19:52.567Z",
  "pubdate": "2026-08-28T20:19:52.567Z",
  "executiveSummary": "The PLANET GS-4210-16P2S switch series is susceptible to an authenticated OS command injection vulnerability, specifically within the web management interface.\nThe flaw resides in the handling of the memberTags POST parameter processed by the /cgi-bin/dispatcher.cgi script.\nAn attacker with authenticated access can exploit this vulnerability to execute arbitrary operating-system commands with the privileges of the web server process.\nThis vulnerability poses a critical risk to network integrity, potentially allowing for full device compromise, persistence, and lateral movement within the network.\nExploitation requires successful authentication to the web-based management console of the device.\nThe vulnerability affects all firmware versions prior to 3.441b260626.",
  "technicalDetails": "The vulnerability is identified as an authenticated OS command injection within the web management interface of the PLANET GS-4210-16P2S.\nThe root cause of this vulnerability is the improper sanitization of user-supplied input provided to the web_vlan_membership_edit_dialog_post handler within the /cgi-bin/dispatcher.cgi file.\nSpecifically, the system fails to validate the content of the memberTags POST parameter before incorporating it directly into a system-level shell command execution context.\nAn authenticated attacker can craft a malicious memberTags payload containing shell metacharacters (such as backticks, semicolons, or pipes) to break out of the intended application logic and execute arbitrary system commands.\nThe attack flow proceeds as follows: 1) The attacker initiates a session by authenticating to the device's web management interface. 2) The attacker navigates to the VLAN membership editing function. 3) The attacker intercepts or crafts a POST request targeting /cgi-bin/dispatcher.cgi. 4) The attacker injects the payload into the memberTags parameter. 5) The dispatcher.cgi script processes the request, passing the unsanitized input to the backend system shell. 6) The underlying OS executes the injected command with the privileges of the web server application, which often runs with elevated administrative permissions.\nBecause the web server operates as a high-privileged entity, the injected commands can manipulate system configurations, modify firewall rules, install persistent backdoors, or exfiltrate sensitive network data.\nThe lack of input validation and the use of dangerous system-level function calls are the primary contributing factors to this command execution primitive.\nThis vulnerability is restricted to the web-based administrative interface and requires the attacker to possess valid administrative credentials, though this does not mitigate the risk of an insider threat or an attacker who has compromised administrative accounts via credential harvesting."
}