Description

PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web_login_first_post handler copies the usrPass POST parameter into a fixed-size stack buffer without length validation, the web_sys_enablePasswd_post handler copies the enbPass POST parameter into a fixed-size stack buffer without length validation, and the web_sys_localUser_post handler copies the usrName and usrPass POST parameters into fixed-size stack buffers without length validation. A remote authenticated attacker can send a crafted request to crash the CGI process or web management service, resulting in denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-28T20:19:55.667Z",
  "pubdate": "2026-08-28T20:19:55.667Z",
  "executiveSummary": "The PLANET GS-4210-16P2S switch, specifically firmware versions prior to 3.441b260626, is susceptible to multiple authenticated stack-based buffer overflow vulnerabilities located within the /cgi-bin/dispatcher.cgi binary.\nThese vulnerabilities stem from improper bounds checking during the processing of user-supplied POST parameters, specifically usrPass, enbPass, and usrName.\nAn authenticated remote attacker can exploit these flaws by supplying maliciously crafted input that exceeds the allocated stack buffer size, leading to the corruption of the stack frame.\nSuccessful exploitation results in the destabilization of the CGI process or the entire web management service, manifesting as a Denial of Service (DoS) condition.\nThe requirement for authentication acts as a security boundary, yet does not mitigate the risk posed by compromised or malicious user accounts.\nGiven the nature of the affected web management service, these vulnerabilities pose a significant risk to device availability and manageability.",
  "technicalDetails": "The vulnerability resides within the /cgi-bin/dispatcher.cgi binary, which handles various administrative POST requests for the PLANET GS-4210-16P2S web management interface.\nThe root cause is a classic stack-based buffer overflow occurring during the handling of specific POST parameters across multiple functions: web_login_first_post, web_sys_enablePasswd_post, and web_sys_localUser_post.\nIn the web_login_first_post handler, the application fails to perform length validation on the 'usrPass' parameter before copying it into a fixed-size stack buffer. Similarly, the web_sys_enablePasswd_post handler lacks validation for the 'enbPass' parameter, and the web_sys_localUser_post handler suffers from the same defect when processing 'usrName' and 'usrPass' fields.\nExploitation follows a predictable sequence: 1) The attacker establishes an authenticated session with the device management interface. 2) The attacker crafts an HTTP POST request containing a payload exceeding the destination buffer's capacity for the targeted parameter. 3) The application’s internal routines invoke insecure copy operations (likely utilizing functions such as strcpy or sprintf without length constraints) to move the attacker-controlled string into the allocated stack memory. 4) The overflow overwrites adjacent memory on the stack, which can include saved return addresses, function pointers, or frame pointers.\nBy overwriting the return address, the attacker can hijack the execution flow of the CGI process. While the primary impact described is a Denial of Service caused by process termination or memory access violations (e.g., SIGSEGV), the overwrite of critical stack data provides the primitives necessary for code execution if the environment lacks modern exploit mitigations like Address Space Layout Randomization (ASLR) or stack canaries.\nBecause the web management interface remains exposed to network traffic, any account with sufficient permissions to access these administrative endpoints can trigger the vulnerability, leading to persistent service disruption and potential compromise of the management plane."
}