CVE-2026-75124
PLANET GS-4210-16P2S Memory Corruption via dispatcher.cgi _readHttpParam
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to dispatcher.cgi to cause denial of service of the web management interface and potentially trigger memory corruption.
| CWE | CWE-120 |
| Vendor | planet technology corp. |
| Product | planet gs-4210-16p2s |
| Published | Aug 28, 2026 |
| Last Updated | Aug 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for planet technology corp. planet gs-4210-16p2s
Be the first to know when new high vulnerabilities affecting planet technology corp. planet gs-4210-16p2s are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
PLANET Technology Corp. / PLANET GS-4210-16P2S
0 < 3.441b260626
References
Credits
Jincheng Wang (@winmt) Professor Le Yu of Nanjing University of Posts and Telecommunications Professor Xiapu Luo of The Hong Kong Polytechnic University