CVE-2026-75123

CVE-2026-75123 is an authenticated OS command injection flaw (CWE-78) in the web management interface of the PLANET GS-4210-16P2S V3 switch, located in the web_smtp_test_post handler of /cgi-bin/dispatcher.cgi. A remote attacker who already holds valid administrator web credentials triggers it by submitting a crafted SMTP server value, which the handler embeds directly into a shell command without sanitization. Successful exploitation allows arbitrary operating-system commands to run on the switch, with high-rated impact on the device's confidentiality, integrity, and availability per the CVSS 4.0 score of 8.6. Only GS-4210-16P2S V3 units running firmware prior to 3.441b260626 are affected, and exploitation requires administrator-level web access, so exposure is limited to deployments where attackers can reach the management interface. There are no reports of in-the-wild exploitation, no known public proof-of-concept, and the CVE is not in CISA KEV; EPSS assigns a 1.1% probability of exploitation within 30 days (65th percentile).

What to do: Upgrade affected GS-4210-16P2S V3 units to firmware 3.441b260626 or later from PLANET. Until patched, restrict access to the web management interface to trusted networks, ensure administrator credentials are strong and not vendor defaults, and avoid using the SMTP test function with untrusted input. Review device logs for unexpected SMTP server values or shell command activity that could indicate prior exploitation.