CVE-2026-77217: Planet Technology Corp Planet Gs-4210-16p2s v3

Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days.

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The web_radiusSrv*_post family of handlers copies the radKey, radKey_0, radDftParamKey, radName, and radIp POST parameters into fixed-size stack buffers without length validation, and additionally dereferences radName and radIp without verifying their presence in the request. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service.

Affected products

• Planet Technology Corp Planet Gs-4210-16p2s v3: before 3.441b260626 (fixed in 3.441b260626)

Published 2026-08-28. Last modified 2026-09-08.