CVE-2026-75121 PLANET Technology Corp. CVE debrief

Who should care

System administrators and security teams responsible for managing and securing PLANET GS-4210-16P2S V3 devices should assess exposure and prioritize remediation. This includes reviewing current firmware versions, restricting access to vulnerable components, and implementing additional security measures to prevent exploitation. Vulnerability management and security teams should also verify that affected devices are included in asset inventories and track

Why it matters

CVE-2026-75121 is a high-severity authenticated OS command injection vulnerability in PLANET GS-4210-16P2S V3 firmware. Defenders should assess exposure, prioritize remediation, and implement additional security measures to prevent exploitation and similar vulnerabilities.

• Remote authenticated attackers can execute arbitrary operating-system commands on the device.
• Successful exploitation could lead to unauthorized access and control of the device.
• Defenders should verify firmware versions and apply updates to prevent exploitation.
• Additional security measures, such as input validation and sanitization, may be necessary to prevent similar vulnerabilities.

Technical summary

The web_vlan_membership_edit_dialog_post handler in /cgi-bin/dispatcher.cgi incorporates the memberTags POST parameter into a shell command without sanitization, allowing a remote authenticated attacker to execute arbitrary operating-system commands on the device. This vulnerability exists in PLANET GS-4210-16P2S V3 firmware before version 3.441b260626. The vulnerability allows for unauthorized command execution, potentially leading to device compromise. System administrators should assess exposure and prioritize remediation.

Defensive priority

High

Recommended defensive actions

• Review and apply firmware updates to ensure version 3.441b260626 or later is installed.
• Restrict access to the /cgi-bin/dispatcher.cgi file and limit the execution of system commands.
• Implement additional security measures, such as input validation and sanitization, to prevent similar vulnerabilities.
• Verify that PLANET GS-4210-16P2S V3 devices are included in asset inventories and assess exposure.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its existence in PLANET GS-4210-16P2S V3 firmware before 3.441b260626 and the potential for authenticated OS command injection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.