Executive brief
The PLANET GS-4210-16P2S V3 is a managed network switch used to control and route data traffic in enterprise environments. An authenticated administrator can exploit an OS command injection vulnerability in the web management interface to execute arbitrary commands directly on the device. This could allow an attacker with admin credentials to take full control of the switch, intercept traffic, or disable network services.
Technical details
CVE-2026-75123 is an authenticated OS command injection vulnerability (CWE-78) in the web_smtp_test_post handler of /cgi-bin/dispatcher.cgi. The vulnerability exists because the handler directly incorporates a caller-supplied SMTP server parameter into a shell command without adequate sanitization or escaping of shell metacharacters. An authenticated remote attacker with administrator-level web credentials can craft a malicious SMTP server value containing shell metacharacters to break out of the intended command context and execute arbitrary OS commands with the privileges of the CGI process. Exploitation requires valid administrator credentials but no additional user interaction. The patched firmware version 3.441b260626 and later address this issue.
Affected products
- PLANET GS-4210-16P2S V3 before 3.441b260626
Timeline
- 2026-08-28: disclosed