CVE-2026-75124 PLANET Technology Corp. CVE debrief

Who should care

Defenders responsible for PLANET GS-4210-16P2S V3 devices with firmware before 3.441b260626 should assess exposure and verify the web management interface for potential memory corruption vulnerabilities.

Why it matters

Defenders should prioritize verifying exposure of PLANET GS-4210-16P2S V3 devices with firmware before 3.441b260626 and assessing the web management interface for potential memory corruption vulnerabilities, as an unauthenticated remote attacker can send an oversized GET request to dispatcher.cgi to cause denial of service and potentially trigger memory corruption.

• Denial of service of the web management interface
• Potential memory corruption requiring verification
• Need for compensating controls to limit access to the web management interface
• Verification of firmware version and patching priority

Technical summary

The _readHttpParam function in PLANET GS-4210-16P2S V3 firmware before 3.441b260626 copies an oversized HTTP query string without guaranteeing NUL termination. This allows parse_query_string to process attacker-controlled data into a fixed-size stack buffer, potentially leading to memory corruption. An unauthenticated remote attacker can exploit this by sending an oversized GET request to dispatcher.cgi, causing denial of service and potentially triggering memory corruption in the web management interface. Defenders should prioritize verifying exposure and assessing the web management interface for potential vulnerabilities.

Defensive priority

Defenders should prioritize verifying exposure of PLANET GS-4210-16P2S V3 devices with firmware before 3.441b260626 and assessing the web management interface for potential memory corruption vulnerabilities.

Recommended defensive actions

• Verify exposure of PLANET GS-4210-16P2S V3 devices with firmware before 3.441b260626
• Assess the web management interface for potential memory corruption vulnerabilities
• Implement compensating controls to limit access to the web management interface
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates a pre-authentication memory corruption vulnerability in the web management interface of PLANET GS-4210-16P2S V3 firmware before 3.441b260626. An unauthenticated remote attacker can send an oversized GET request to dispatcher.cgi to cause denial of service of the web management interface and potentially trigger memory corruption.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.