Buffer overflow in Planet Technology Corp. Gs-4210-16p2s
CVE-2026-75124
PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to dispatcher.cgi to cause denial of service of the web management interface and potentially trigger memory corruption.
Vulnerability class: Buffer Overflow
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory, patch)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-75124?
- CVE-2026-75124 is a high-severity vulnerability in Planet Technology Corp. Gs-4210-16p2s, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 7.5/10. Published 2026-08-28.
- How severe is CVE-2026-75124?
- High severity. CVSS v3 base score is 7.5 out of 10.