Description

PLANET GS-4210-16P2S firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy attacker-controlled POST parameters into fixed-size stack buffers without length validation: web_vlan_membership_edit_dialog_post; web_dai_vlan_post; web_poe_alive_rmtip_post; web_sys_sntp_post; web_tool_upgradeManager_post; web_port_countersClr_post; web_rmon_statisticsClr_post; web_cablediag_copper_post; web_aaa_*Authlist* handlers; web_acl_mgmt_Rules_Apply_post; web_acl_mgmt_Rules_Edit_post; web_acl_*AceDel_post handlers; web_acl_*AceAdd/Edit_post handlers; web_acl_bindAdd_post; web_acl_bindEdit_post; web_snmp_v3view_add_post; web_snmp_v3group_add_post; web_snmp_v3community_add_post; web_snmp_v3host_add_post; web_snmp_notifyv3_add_post; web_snmp_v3user_add_post; web_snmpv3_remote_engineId_add_post; web_stp_globalSetting_post; web_isg_db_post; web_tacplus*_post handlers; web_dhcp_option82_post; and web_dhcp_port_option82_cid_post. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-28T20:19:53.250Z",
  "pubdate": "2026-08-28T20:19:53.250Z",
  "executiveSummary": "The PLANET GS-4210-16P2S switch series, in firmware versions prior to 3.441b260626, contains multiple authenticated stack-based buffer overflow vulnerabilities. These flaws reside within the /cgi-bin/dispatcher.cgi component, which handles web-based management requests.\nThe vulnerability type is a stack-based buffer overflow resulting from improper bounds checking on user-supplied input. An attacker with valid authentication credentials can send specially crafted POST requests to various handlers within the CGI application. By providing oversized input that exceeds the allocation of fixed-size stack buffers, an attacker can overwrite memory, leading to the corruption of the execution stack.\nThe primary impact of successful exploitation is a Denial of Service (DoS) condition, where the CGI process or the entire web management service becomes unresponsive. While the current disclosure highlights service instability, stack-based overflows frequently offer primitives for arbitrary code execution in the context of the web server process. The risk is significant, as it allows a malicious or compromised authenticated user to disrupt critical network management capabilities of the switch, potentially leading to unauthorized system resets or prolonged management downtime. Exploitation requires authenticated access to the web management interface.",
  "technicalDetails": "The vulnerabilities exist within the /cgi-bin/dispatcher.cgi file, which acts as a centralized dispatch mechanism for various configuration and management tasks on the PLANET GS-4210-16P2S. The root cause is the usage of insecure memory copy operations—likely standard C functions such as strcpy(), sprintf(), or gets()—which move attacker-controlled POST parameters directly into fixed-size stack buffers without validating the input length against the target buffer capacity.\nThe affected handlers include a wide array of system and service management functions, such as web_vlan_membership_edit_dialog_post, web_poe_alive_rmtip_post, web_tool_upgradeManager_post, web_acl_mgmt_Rules_Apply_post, and numerous SNMPv3 configuration handlers (e.g., web_snmp_v3user_add_post). The breadth of affected functions indicates a systematic lack of input sanitization and length enforcement across the dispatcher's underlying logic.\nThe exploitation flow begins with a remote, authenticated attacker constructing an HTTP POST request targeting one of the identified CGI handlers. Within the request body, the attacker includes malicious parameter values designed to exceed the maximum permitted length for the target buffer. As the /cgi-bin/dispatcher.cgi process parses these parameters, the lack of validation causes the excess data to overflow the stack frame assigned to the respective handler function. This results in the overwriting of critical stack data, including saved return addresses, function pointers, or saved frame pointers.\nIn the context of the reported impact, the memory corruption leads to an illegal memory access or an invalid state transition during function return, which triggers a crash of the CGI service. If the process is not automatically respawned, or if the crash is severe enough to destabilize the web management daemon, the administrator loses the ability to manage the device through the web GUI. Because these buffers reside on the stack, the vulnerability provides a mechanism for an attacker to potentially control the instruction pointer (IP) upon function return. If the device lacks modern binary protections such as Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP/NX), or stack canaries, an attacker could potentially redirect the execution flow to arbitrary code, such as return-oriented programming (ROP) chains, to escalate privileges or gain persistent control over the device. The attack is restricted to the network segment accessible to the web management interface and requires valid administrative or user-level credentials to initiate the trigger."
}