Description

PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to dispatcher.cgi to cause denial of service of the web management interface and potentially trigger memory corruption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T20:19:52.970Z",
  "pubdate": "2026-08-28T20:19:52.970Z",
  "executiveSummary": "A critical pre-authentication memory corruption vulnerability exists within the web management interface of the PLANET GS-4210-16P2S switch, specifically affecting firmware versions prior to 3.441b260626.\nThe vulnerability is rooted in an improper bounds check during the processing of HTTP query strings, which facilitates a stack-based buffer overflow.\nSuccessful exploitation allows an unauthenticated, remote attacker to compromise the integrity and availability of the web management service. By transmitting a maliciously crafted GET request to the dispatcher.cgi endpoint, an attacker can trigger a denial-of-service (DoS) condition or achieve arbitrary memory corruption.\nGiven the nature of the vulnerability occurring during the pre-authentication phase, no valid user credentials are required to initiate the attack, significantly increasing the risk to exposed devices.\nThe primary risk involves the potential for service instability, unauthorized memory modification, and potential remote code execution depending on the state of the stack and the attacker's payload precision.",
  "technicalDetails": "The vulnerability originates in the _readHttpParam function within the device's web management firmware, which is responsible for parsing parameters from incoming HTTP requests. During the handling of a GET request directed at dispatcher.cgi, the application attempts to copy the provided HTTP query string into a fixed-size stack buffer without verifying the input length or ensuring proper NUL termination.\nThe vulnerability is characterized by a stack-based buffer overflow triggered by the parse_query_string function. Because the buffer is of a fixed, static size, providing an oversized query string exceeds the allocated memory segment on the stack, allowing attacker-controlled data to overwrite adjacent memory, including function return addresses or saved frame pointers.\nThe attack flow begins when an unauthenticated remote attacker sends a specifically crafted HTTP GET request to the web interface. The dispatcher.cgi component passes the URI parameters to _readHttpParam, which performs an unsafe memory copy operation. Because there is no input sanitization or length enforcement, the payload overflows the buffer, corrupting the stack frame.\nThe lack of NUL termination in the copy routine exacerbates the vulnerability, as it may cause subsequent string-handling functions to read beyond the intended buffer bounds, leading to unpredictable program behavior or memory corruption.\nImpact ranges from service disruption, causing the web management interface to crash and enter an unresponsive state (DoS), to the potential for code execution if an attacker can successfully control the instruction pointer. The vulnerability is exploitable via the network, making any device with an exposed web management interface susceptible to remote attacks without prior authentication or privilege escalation."
}