CVE-2026-75121

PLANET GS-4210-16P2S V3 switches running firmware before 3.441b260626 contain an OS command injection flaw (CWE-78) in the web UI handler web_vlan_membership_edit_dialog_post of /cgi-bin/dispatcher.cgi. The handler takes the memberTags POST parameter, supplied when editing VLAN membership, and inserts it into a shell command without sanitization, so a crafted value executes arbitrary operating-system commands on the device. A remote attacker who has valid web UI credentials — high-privilege access per the CVSS 4.0 vector — can run commands with the switch's privileges, which typically means full control of the device. Only GS-4210-16P2S units on hardware revision V3 with affected firmware are impacted. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS puts the 30-day exploitation probability at about 1.1%.

What to do: Upgrade affected GS-4210-16P2S V3 units to firmware 3.441b260626 or later. Until patched, restrict access to the switch web UI (allowlisting or VPN), use strong unique admin credentials, and monitor VLAN-membership edit activity for anomalies. Confirm the hardware revision is V3 on the device label or web UI, as only that revision is named in the advisory.