Description

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A remote attacker with administrator web credentials can submit a crafted certificate upload request to execute arbitrary operating-system commands on the device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-28T20:19:52.707Z",
  "pubdate": "2026-08-28T20:19:52.707Z",
  "executiveSummary": "The PLANET GS-4210-16P2S switch series is susceptible to an authenticated OS command injection vulnerability located within the certificate management interface. This security flaw, present in firmware versions prior to 3.441b260626, allows a remote attacker who has successfully authenticated with administrative privileges to execute arbitrary system-level commands.\nThe vulnerability originates from improper input sanitization within the /cgi-bin/httpuploadcert.cgi script, specifically concerning the certificate password field. By injecting malicious shell metacharacters, an attacker can escape the intended input boundaries to manipulate the underlying operating system shell. Successful exploitation results in full remote code execution (RCE) with the privileges of the web server process, potentially leading to complete system compromise, persistence, or lateral movement within the network. Mitigation requires immediate firmware updates to the patched version, as the flaw presents a critical risk to device integrity and confidentiality.",
  "technicalDetails": "The vulnerability resides within the /cgi-bin/httpuploadcert.cgi script, which handles the processing of certificate uploads. The root cause of this flaw is the insecure handling of user-supplied data, where the input provided to the certificate password field is concatenated directly into a backend shell command without adequate validation or sanitization of shell metacharacters (e.g., semicolons, backticks, or pipes).\nExploitation is achieved by initiating a crafted HTTP request to the target device. An attacker must possess valid administrator web credentials to access the administrative panel. During the certificate upload process, the attacker substitutes the expected password string with a payload designed to terminate the intended command and append malicious OS instructions. For example, by supplying a payload containing command separators, the attacker can force the system shell to execute secondary processes.\nThe attack flow follows a structured path: First, the attacker establishes an authenticated session with the management interface. Second, the attacker triggers the file upload function, directing the request to /cgi-bin/httpuploadcert.cgi. Third, the attacker populates the password parameter with a command injection payload. The web application's backend processes the request and passes the tainted input to a system() or similar execution function. Because the input is not sanitized, the shell interprets the injected characters as control operators, resulting in the execution of arbitrary commands with the effective privileges of the web service.\nAffected firmware versions include all iterations prior to 3.441b260626. Because the execution occurs at the OS level, an attacker can gain full visibility into the device's configuration, exfiltrate sensitive data, modify system files, or establish a reverse shell for persistent access. This command injection capability effectively bypasses the functional restrictions of the web UI, allowing the attacker to interact directly with the device's kernel and filesystem. The vulnerability is network-exposed, as the web management interface is reachable over the network, though it remains protected by the prerequisite of administrative authentication."
}