Null Pointer Dereference in PLANET GS-4210-16P2S Firmware
CVE-2026-75125

6.9MEDIUM

Key Information:

Vendor

Planet Technology Corp.

Status
Planet Gs-4210-16p2s V3
Vendor
CVE Published:
28 August 2026

What is CVE-2026-75125?

The firmware of the PLANET GS-4210-16P2S device is susceptible to a null pointer dereference vulnerability located in /cgi-bin/dispatcher.cgi. This weakness arises because the web_poe_alive_rmtip_post handler does not adequately verify the presence of the rmtIP parameter before dereferencing it. As a result, a remote authenticated attacker can exploit this flaw by sending a crafted request that excludes the rmtIP parameter, leading to a null pointer dereference. This can cause the CGI process to crash, resulting in a denial of service condition for the web management interface.

Affected Version(s)

PLANET GS-4210-16P2S V3 0 < 3.441b260626

References

https://www.planet.com.tw/en/support/security-advisory/10
vendor-advisorypatch
https://www.vulncheck.com/advisories/planet-gs-4210-16p2s...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt)
Professor Le Yu of Nanjing University of Posts and Telecommunications
Professor Xiapu Luo of The Hong Kong Polytechnic University
.