CVE-2026-75123

Received Received - Intake

Authenticated OS Command Injection in PLANET GS-4210-16P2S Firmware

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with administrator web credentials can send a crafted SMTP server value to execute arbitrary operating-system commands on the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-75123

EUVD

EUVD-2026-67783

Affected Vendors & Products

Vendor	Product	Version / Range
planet	gs-4210-16p2s	to 3.441b260626 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is an authenticated OS command injection vulnerability in PLANET GS-4210-16P2S firmware before version 3.441b260626. The flaw exists in the /cgi-bin/dispatcher.cgi file, specifically in the web_smtp_test_post handler. The handler fails to properly sanitize user-supplied SMTP server input before using it in a shell command. An attacker with administrator web credentials can exploit this by sending a crafted SMTP server value to execute arbitrary operating system commands on the device.

Detection Guidance

To detect this vulnerability, check the firmware version of your PLANET GS-4210-16P2S device. If it is below 3.441b260626, the device is vulnerable. Log in to the device's web interface and navigate to the system information or firmware update section to verify the version.

Impact Analysis

An attacker could gain full control over the affected device, leading to potential data theft, unauthorized access, or disruption of services. Since the vulnerability requires administrator credentials, the primary risk is for organizations using this device in their network infrastructure where such access could be obtained through other means.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, and other regulations. Organizations could face legal penalties, reputational damage, and loss of customer trust if such an incident occurs due to inadequate security controls.

Mitigation Strategies

Immediately update the firmware to version 3.441b260626 or later. If an update is not immediately available, restrict administrative web access to trusted networks and users to reduce the attack surface until the patch can be applied.

Hi! I’m here to help you understand CVE-2026-75123. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70