# CVE-2026-75122: PLANET GS-4210-16P2S V3 OS command injection in certificate upload

Source: https://junglewise.ai/threats/cve-2026-75122-planet-gs-4210-16p2s-v3-os-command-injection-in-certificate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75122 · Severity: high · CVSS 7.2 · Published 2026-08-28

PLANET GS-4210-16P2S V3 is a managed network switch used to connect and control enterprise network infrastructure. This vulnerability allows an administrator with access to the web management interface to execute arbitrary system commands on the switch by uploading a malicious certificate, potentially compromising the device's security and allowing lateral movement into the network.

Technologies: [PLANET GS-4210-16P2S V3](https://junglewise.ai/threats/technologies/gs-4210-16p2s-v3). Vendors: [PLANET](https://junglewise.ai/threats/vendors/planet).

## Quick answers

**Is CVE-2026-75122 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75122 being exploited in the wild.

**How severe is CVE-2026-75122?** High severity, with a CVSS score of 7.2, published 28 August 2026.

**Which products and versions are affected?** PLANET GS-4210-16P2S V3 before 3.441b260626.

**Is there a fix for CVE-2026-75122?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75122 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75122?** Check whether you run PLANET GS-4210-16P2S V3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authenticated OS command injection vulnerability (CWE-78) in the /cgi-bin/httpuploadcert.cgi endpoint. The certificate password field provided during certificate upload requests is incorporated directly into shell commands without sanitization of shell metacharacters, allowing command injection. An attacker with administrator-level web credentials can craft a malicious certificate upload request with shell metacharacters in the password field to execute arbitrary OS commands on the device. The vulnerability requires prior authentication as an administrator and network access to the web management interface. Patched firmware version 3.441b260626 and later address this issue.

## Affected products

- PLANET GS-4210-16P2S V3 before 3.441b260626

## Timeline

- 2026-08-28: disclosed

## References

- [https://www.planet.com.tw/en/support/security-advisory/10](https://www.planet.com.tw/en/support/security-advisory/10)
- [https://www.vulncheck.com/advisories/planet-gs-4210-16p2s-command-injection-via-httpuploadcert-cgi](https://www.vulncheck.com/advisories/planet-gs-4210-16p2s-command-injection-via-httpuploadcert-cgi)

## Related threats

- [PLANET GS-4210-16P2S V3 stack buffer overflow in dispatcher.cgi](https://junglewise.ai/threats/cve-2026-77218-planet-gs-4210-16p2s-v3-stack-buffer-overflow-in-dispatcher-cgi)
- [PLANET GS-4210-16P2S V3 stack buffer overflow in RADIUS handlers](https://junglewise.ai/threats/cve-2026-77217-planet-gs-4210-16p2s-v3-stack-buffer-overflow-in-radius-handlers)
- [PLANET GS-4210-16P2S V3 stack buffer overflow in dispatcher.cgi handlers](https://junglewise.ai/threats/cve-2026-75126-planet-gs-4210-16p2s-v3-stack-buffer-overflow-in-dispatcher-cgi)
- [PLANET GS-4210-16P2S V3 null pointer dereference in dispatcher.cgi](https://junglewise.ai/threats/cve-2026-75125-planet-gs-4210-16p2s-v3-null-pointer-dereference-in-dispatcher)
- [PLANET GS-4210-16P2S V3 pre-authentication memory corruption](https://junglewise.ai/threats/cve-2026-75124-planet-gs-4210-16p2s-v3-pre-authentication-memory-corruption)