OS Command Injection Vulnerability in PLANET GS-4210-16P2S Firmware
CVE-2026-75123

8.6HIGH

Key Information:

Vendor

Planet Technology Corp.

Status
Planet Gs-4210-16p2s V3
Vendor
CVE Published:
28 August 2026

What is CVE-2026-75123?

The firmware of the PLANET GS-4210-16P2S is susceptible to an OS command injection due to improper handling of a user-supplied SMTP server value within the web_smtp_test_post handler in /cgi-bin/dispatcher.cgi. An attacker with administrative credentials can manipulate this handler, allowing for the execution of arbitrary shell commands on the device. This poses a significant risk as it may enable unauthorized access and control over the device's operating system.

Affected Version(s)

PLANET GS-4210-16P2S V3 0 < 3.441b260626

References

https://www.planet.com.tw/en/support/security-advisory/10
vendor-advisorypatch
https://www.vulncheck.com/advisories/planet-gs-4210-16p2s...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt)
Professor Le Yu of Nanjing University of Posts and Telecommunications
Professor Xiapu Luo of The Hong Kong Polytechnic University
.