CVE-2026-75122: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in PLANET Technology Corp. PLANET GS-4210-16P2S V3

CVE-2026-75122 is an authenticated OS command injection vulnerability affecting PLANET GS-4210-16P2S V3 firmware prior to version 3.441b260626. The vulnerability arises because the certificate password field in a certificate upload request is incorporated into a shell command without proper sanitization of shell metacharacters. An attacker with administrator-level web access can exploit this flaw by submitting a specially crafted certificate upload request to execute arbitrary operating system commands on the device.

Successful exploitation allows an attacker with administrator web credentials to execute arbitrary operating system commands on the affected device, potentially leading to full system compromise or disruption of device functionality. The vulnerability requires authenticated access, limiting exploitation to users with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator web access to trusted users only and monitor for suspicious certificate upload activity. Avoid exposing the management interface to untrusted networks.