CVE-2026-75123 PLANET Technology Corp. CVE debrief

Who should care

Network administrators, security teams, and IT personnel responsible for managing PLANET GS-4210-16P2S V3 devices should assess exposure and apply patches or mitigations to prevent exploitation.

Why it matters

CVE-2026-75123 is a high-severity authenticated OS command injection vulnerability in PLANET GS-4210-16P2S V3 firmware. Network administrators and security teams should assess exposure and apply patches or mitigations to prevent exploitation. The vulnerability allows a remote attacker with administrator web credentials to execute arbitrary operating-system commands on the device. The scope of affected versions and devices requires verification from the vendor and official sources.

• Remote code execution with administrator privileges
• Potential for lateral movement within the network
• Data tampering or unauthorized access to sensitive information
• Disruption of network operations and services

Technical summary

The web_smtp_test_post handler in /cgi-bin/dispatcher.cgi incorporates a caller-supplied SMTP server value directly into a shell command without sanitization, allowing a remote attacker with administrator web credentials to execute arbitrary operating-system commands on the device. This vulnerability exists in PLANET GS-4210-16P2S V3 firmware before 3.441b260626. The vulnerability allows for potential lateral movement within the network and data tampering or unauthorized access to sensitive information. Network administrators and security teams should assess exposure and apply patches or mitigations to prevent exploitation.

Defensive priority

High priority for network administrators and security teams to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure by inventorying PLANET GS-4210-16P2S V3 devices and checking firmware versions.
• Verify if administrator web credentials have been compromised or are vulnerable to exploitation.
• Apply patches or updates to firmware version 3.441b260626 or later.
• Implement compensating controls, such as restricting access to the /cgi-bin/dispatcher.cgi file.
• Monitor for suspicious activity and implement exception tracking.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and devices requires verification from the vendor and official sources. The PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability. Network administrators and security teams should verify the firmware versions of their devices and assess exposure. The web_smtp_test_post handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.