# CVE-2026-75123: PLANET GS-4210-16P2S V3 OS command injection in dispatcher.cgi

Source: https://junglewise.ai/threats/cve-2026-75123-planet-gs-4210-16p2s-v3-os-command-injection-in-dispatcher-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75123 · Severity: high · CVSS 7.2 · Published 2026-08-28

The PLANET GS-4210-16P2S V3 is a managed network switch used to control and route data traffic in enterprise environments. An authenticated administrator can exploit an OS command injection vulnerability in the web management interface to execute arbitrary commands directly on the device. This could allow an attacker with admin credentials to take full control of the switch, intercept traffic, or disable network services.

Technologies: [PLANET GS-4210-16P2S V3](https://junglewise.ai/threats/technologies/gs-4210-16p2s-v3). Vendors: [PLANET](https://junglewise.ai/threats/vendors/planet).

## Quick answers

**Is CVE-2026-75123 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75123 being exploited in the wild.

**How severe is CVE-2026-75123?** High severity, with a CVSS score of 7.2, published 28 August 2026.

**Which products and versions are affected?** PLANET GS-4210-16P2S V3 before 3.441b260626.

**Is there a fix for CVE-2026-75123?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75123 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75123?** Check whether you run PLANET GS-4210-16P2S V3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-75123 is an authenticated OS command injection vulnerability (CWE-78) in the web_smtp_test_post handler of /cgi-bin/dispatcher.cgi. The vulnerability exists because the handler directly incorporates a caller-supplied SMTP server parameter into a shell command without adequate sanitization or escaping of shell metacharacters. An authenticated remote attacker with administrator-level web credentials can craft a malicious SMTP server value containing shell metacharacters to break out of the intended command context and execute arbitrary OS commands with the privileges of the CGI process. Exploitation requires valid administrator credentials but no additional user interaction. The patched firmware version 3.441b260626 and later address this issue.

## Affected products

- PLANET GS-4210-16P2S V3 before 3.441b260626

## Timeline

- 2026-08-28: disclosed

## References

- [https://www.planet.com.tw/en/support/security-advisory/10](https://www.planet.com.tw/en/support/security-advisory/10)
- [https://www.vulncheck.com/advisories/planet-gs-4210-16p2s-command-injection-via-dispatcher-cgi-web-smtp-test-post](https://www.vulncheck.com/advisories/planet-gs-4210-16p2s-command-injection-via-dispatcher-cgi-web-smtp-test-post)

## Related threats

- [PLANET GS-4210-16P2S V3 stack buffer overflow in dispatcher.cgi](https://junglewise.ai/threats/cve-2026-77218-planet-gs-4210-16p2s-v3-stack-buffer-overflow-in-dispatcher-cgi)
- [PLANET GS-4210-16P2S V3 stack buffer overflow in RADIUS handlers](https://junglewise.ai/threats/cve-2026-77217-planet-gs-4210-16p2s-v3-stack-buffer-overflow-in-radius-handlers)
- [PLANET GS-4210-16P2S V3 stack buffer overflow in dispatcher.cgi handlers](https://junglewise.ai/threats/cve-2026-75126-planet-gs-4210-16p2s-v3-stack-buffer-overflow-in-dispatcher-cgi)
- [PLANET GS-4210-16P2S V3 null pointer dereference in dispatcher.cgi](https://junglewise.ai/threats/cve-2026-75125-planet-gs-4210-16p2s-v3-null-pointer-dereference-in-dispatcher)
- [PLANET GS-4210-16P2S V3 pre-authentication memory corruption](https://junglewise.ai/threats/cve-2026-75124-planet-gs-4210-16p2s-v3-pre-authentication-memory-corruption)