Description

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_alive_rmtip_post handler dereferences the rmtIP parameter without verifying its presence. A remote authenticated attacker can send a crafted request omitting the rmtIP parameter to cause the CGI process to dereference a null pointer and crash, resulting in denial of service of the web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-28T20:19:53.103Z",
  "pubdate": "2026-08-28T20:19:53.103Z",
  "executiveSummary": "The PLANET GS-4210-16P2S switch, running firmware versions prior to 3.441b260626, is susceptible to an authenticated null pointer dereference vulnerability.\nThis vulnerability resides within the web management interface, specifically inside the /cgi-bin/dispatcher.cgi component.\nA remote authenticated attacker can trigger a crash of the CGI process by sending a crafted HTTP request that omits a required parameter, leading to a Denial of Service (DoS) of the device's web management capabilities.\nThe primary risk involves the interruption of administrative availability and management functions.\nSuccessful exploitation requires valid credentials to access the administrative web interface, but no further privileges beyond standard authenticated access are necessitated to induce the crash condition.\nThe impact is limited to the availability of the management service; the underlying switching functionality is typically unaffected by this specific web-based crash, but the ability to manage or reconfigure the device is rendered impossible until the process is restored.",
  "technicalDetails": "The vulnerability is a classic null pointer dereference occurring within the binary handling the /cgi-bin/dispatcher.cgi endpoint. Specifically, the web_poe_alive_rmtip_post handler process fails to implement adequate input validation regarding the rmtIP parameter before attempting to access the memory address associated with that parameter.\nThe root cause is a failure in the software's error handling logic, where the application assumes that the rmtIP parameter will always be present in the POST request body. When a crafted request is submitted that omits the rmtIP field, the handler retrieves a null pointer. The process proceeds to perform a memory operation on this null pointer, triggering a segmentation fault (SIGSEGV) and terminating the CGI process instance.\nThe attack flow begins with an attacker obtaining valid administrative authentication to the device's web interface. Once authenticated, the attacker crafts a malicious HTTP POST request targeting /cgi-bin/dispatcher.cgi. This request is specifically designed to interact with the web_poe_alive_rmtip_post function while deliberately omitting the expected rmtIP parameter. The web server receives this malformed input and passes it to the dispatcher process. Because the input validation logic is absent or insufficient, the handler attempts to dereference the pointer, resulting in an immediate crash of the service.\nThe component affected is the web management system's CGI interface, which manages the Power over Ethernet (PoE) functionality. Because the crash occurs within the dispatcher process that serves web requests, the management interface becomes unreachable or unresponsive to further administrative commands.\nThis vulnerability is classified as a remote denial of service. The scope is confined to the authentication domain of the device; therefore, unauthorized attackers cannot trigger this crash from an unauthenticated state. However, once a session is established, the exploitation is deterministic and reliable, causing the management service to fail every time the malformed request is successfully processed.\nPost-exploitation impact is limited to the loss of administrative control over the switch via the web GUI. Depending on the device's internal watchdog mechanism or process management implementation, the service may either require a manual system reboot or fail to restart automatically, leaving the administrator with no means to manage the switch configuration until the management service is restored."
}