Description

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with administrator web credentials can send a crafted SMTP server value to execute arbitrary operating-system commands on the device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-28T20:19:52.837Z",
  "pubdate": "2026-08-28T20:19:52.837Z",
  "executiveSummary": "The PLANET GS-4210-16P2S firmware prior to version 3.441b260626 is susceptible to an authenticated OS command injection vulnerability. This flaw exists within the /cgi-bin/dispatcher.cgi component, specifically affecting the web_smtp_test_post handler. An attacker possessing valid administrative credentials can exploit this vulnerability to execute arbitrary operating-system commands on the affected device. The root cause is the improper sanitization of user-supplied input provided to the SMTP server configuration field, which is subsequently passed to a system-level shell. Successful exploitation allows for complete device compromise, potentially resulting in unauthorized configuration changes, persistent backdoor installation, or the usage of the device as a pivot point within the network. Because the vulnerability requires administrative access, the primary risk is associated with account compromise or malicious insiders. Remediation requires updating the device firmware to version 3.441b260626 or later to address the insecure command execution logic.",
  "technicalDetails": "The vulnerability resides within the /cgi-bin/dispatcher.cgi file of the PLANET GS-4210-16P2S firmware. This script serves as a central dispatch mechanism for various web interface requests. Specifically, the web_smtp_test_post function is designed to validate SMTP configurations by initiating a connectivity test through a shell command. The vulnerability arises because the input provided to the 'SMTP server' parameter is directly concatenated into a system shell command string without adequate input validation, filtering, or escaping of shell metacharacters.\nThe exploitation process follows a predictable pattern. An attacker must first authenticate to the web management interface using administrative credentials. Once authenticated, the attacker navigates to the SMTP configuration testing utility. During the test execution, the attacker intercepts or crafts a POST request directed at /cgi-bin/dispatcher.cgi. By injecting shell metacharacters such as backticks (`), semicolons (;), or pipes (|) into the SMTP server address field, the attacker can break out of the intended command context.\nFor example, if the underlying implementation executes a command similar to 'ping -c 1 [SMTP_SERVER]', an attacker supplying an input like '127.0.0.1; reboot' would cause the system to execute the ping command followed immediately by the reboot command. More sophisticated payloads can be utilized to establish reverse shells or download malicious scripts from remote servers, as the command execution occurs with the privileges of the web service process, which often operates with elevated system permissions.\nThis vulnerability is classified as an authenticated OS command injection. It is persistent as long as the vulnerable firmware remains in use and is accessible over the network. The scope of impact is limited to the device itself but serves as a critical vector for lateral movement and full device takeover. Because the sanitization failure is located in a backend handler, the vulnerability cannot be mitigated by client-side browser controls and requires a patch to the backend CGI implementation to enforce strict input validation or to replace the direct shell invocation with a safer API call that avoids shell interpretation."
}