Authenticated OS Command Injection in PLANET GS-4210-16P2S Firmware
CVE-2026-75121

8.6HIGH

Key Information:

Vendor

Planet Technology Corp.

Status
Planet Gs-4210-16p2s V3
Vendor
CVE Published:
28 August 2026

What is CVE-2026-75121?

The firmware of PLANET GS-4210-16P2S, prior to version 3.441b260626, contains an OS command injection vulnerability within the /cgi-bin/dispatcher.cgi component. This occurs when the web_vlan_membership_edit_dialog_post handler processes the memberTags POST parameter without appropriate sanitization. A remote authenticated attacker may exploit this weakness by submitting a crafted value for memberTags, allowing them to execute arbitrary operating-system commands on the vulnerable device.

Affected Version(s)

PLANET GS-4210-16P2S V3 0 < 3.441b260626

References

https://www.planet.com.tw/en/support/security-advisory/10
vendor-advisorypatch
https://www.vulncheck.com/advisories/planet-gs-4210-16p2s...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt)
Professor Le Yu of Nanjing University of Posts and Telecommunications
Professor Xiapu Luo of The Hong Kong Polytechnic University
.