CVE-2026-75124

CVE-2026-75124 is a pre-authentication memory corruption flaw (CWE-120) in the web management interface of PLANET GS-4210-16P2S V3 switches, where the _readHttpParam function copies an attacker-controlled HTTP query string without guaranteeing NUL termination. An unauthenticated remote attacker can trigger it by sending an oversized GET request to dispatcher.cgi, causing parse_query_string to process the unterminated data into a fixed-size stack buffer. The demonstrated impact is denial of service of the web management interface, with potential additional memory corruption; the CVSS 4.0 score of 8.7 (AV:N/VA:H with all other impact metrics None) reflects high availability impact only. Any organization running this switch model on V3 firmware prior to 3.441b260626 is affected, though the described impact is limited to the management interface rather than switch forwarding. No public PoC exists, the flaw is not in CISA KEV, and EPSS assigns a 0.5% (40th percentile) probability of exploitation within 30 days, so no exploitation is currently known.

What to do: Upgrade GS-4210-16P2S V3 units to firmware 3.441b260626 or later. Until patched, restrict access to the web management interface (dispatcher.cgi) to trusted management networks via firewall/ACL rules and avoid exposing HTTP management to the internet. Inventory the network for this model and confirm which firmware revision each unit runs.