Description

PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The web_radiusSrv*_post family of handlers copies the radKey, radKey_0, radDftParamKey, radName, and radIp POST parameters into fixed-size stack buffers without length validation, and additionally dereferences radName and radIp without verifying their presence in the request. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-28T20:19:55.533Z",
  "pubdate": "2026-08-28T20:19:55.533Z",
  "executiveSummary": "The PLANET GS-4210-16P2S switch series, running firmware versions prior to 3.441b260626, is susceptible to authenticated stack-based buffer overflow and null pointer dereference vulnerabilities located within the /cgi-bin/dispatcher.cgi component.\nThese vulnerabilities stem from insufficient input sanitization and inadequate validation of user-supplied POST parameters handled by the web_radiusSrv*_post functions.\nA remote authenticated attacker can exploit these flaws by supplying crafted payloads, potentially leading to the crash of the CGI process or the entire web management service, resulting in a Denial of Service (DoS) condition.\nThe risk is categorized as significant for network infrastructure as it impacts the availability of the management interface. Successful exploitation requires the attacker to hold valid authentication credentials to access the management web portal, effectively limiting the attack surface to authorized users or those who have compromised legitimate administrative accounts.\nThere are no documented code execution implications beyond service disruption, but the instability of the web management service may hinder security auditing and emergency configuration tasks during an incident.",
  "technicalDetails": "The vulnerabilities reside in the /cgi-bin/dispatcher.cgi binary, specifically within the logic handling RADIUS server configuration requests. The web_radiusSrv*_post family of handlers is responsible for processing administrative changes to RADIUS settings, including parameters identified as radKey, radKey_0, radDftParamKey, radName, and radIp.\nThe primary root cause for the stack-based buffer overflow is the application's failure to perform bounds checking when copying these user-supplied POST parameters into fixed-size stack-allocated memory buffers. By submitting POST requests containing parameters that exceed the allocated buffer capacity, an attacker can trigger memory corruption, overwriting adjacent stack frames, including return addresses, which leads to immediate process termination and a service crash.\nIn addition to the buffer overflow, the handler routines exhibit a null pointer dereference vulnerability. The application logic attempts to dereference pointers associated with the radName and radIp parameters without verifying that these fields exist within the incoming POST request body. If these parameters are omitted from a crafted request, the application attempts to process a null memory address, resulting in an unhandled exception that causes the CGI process to abort.\nThe exploitation lifecycle follows a linear path: First, an attacker must establish an authenticated session with the switch's web management interface. Once authenticated, the attacker constructs a malicious HTTP POST request targeting /cgi-bin/dispatcher.cgi. By populating the request with intentionally oversized strings for the affected keys, the attacker forces a buffer overflow. Alternatively, by omitting the radName or radIp parameters, the attacker forces the service to access null memory pointers.\nThe post-exploitation impact is primarily service degradation. Since the web management interface runs as a service managed by the underlying operating system of the switch, repeatedly triggering these crashes forces the service into a state of continuous unavailability, effectively disabling remote management capabilities for the device.\nThe vulnerability affects all firmware versions of the PLANET GS-4210-16P2S prior to version 3.441b260626. Because these CGI handlers operate within the context of the web server thread, the process instability is contained within the management plane and does not immediately compromise the underlying switching fabric, though it may leave the device in an unmanaged state until a manual reboot or service recovery occurs."
}