Authenticated OS Command Injection in PLANET GS-4210-16P2S

PLANET GS-4210-16P2S network switches running firmware versions prior to 3.441b260626 are susceptible to an authenticated OS command injection vulnerability. The flaw exists within the /cgi-bin/dispatcher.cgi endpoint, specifically handled by the web_vlan_membership_edit_dialog_post function. An attacker with valid administrative or authenticated credentials can craft a malicious HTTP POST request containing a manipulated memberTags parameter. Because the application fails to properly sanitize this input before passing it to the underlying system shell, an attacker can execute arbitrary operating-system commands with the privileges of the web management process. This vulnerability is tracked as CVE-2026-75121 and poses a significant risk for lateral movement or persistence on the internal network through compromised networking infrastructure.

Impact

Successful exploitation allows an authenticated attacker to gain full command execution on the target GS-4210-16P2S switch. This can lead to unauthorized configuration changes, traffic interception, network reconnaissance, or the use of the switch as a staging point for further attacks within the local area network. Given the role of these devices in managing VLANs and internal traffic, compromise could have broad ramifications for internal segmentation and security policy enforcement.

Recommendation

Prioritized actions for security operations and IT teams include:

• Patching: Update all PLANET GS-4210-16P2S devices to firmware version 3.441b260626 or later immediately.
• Access Control: Limit access to the device web management interface to trusted administrative IPs only using hardware-based ACLs or isolated management VLANs.
• Credential Management: Audit and rotate all administrative credentials on PLANET switches to reduce the risk of unauthorized access required for this exploitation.
• Monitoring: Monitor web server access logs for anomalous POST requests to /cgi-bin/dispatcher.cgi, particularly those containing shell metacharacters in the memberTags field.