CVE-2026-75124: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in PLANET Technology Corp. PLANET GS-4210-16P2S V3

CVE-2026-75124 is a classic buffer overflow vulnerability in PLANET Technology Corp.'s PLANET GS-4210-16P2S V3 firmware prior to 3.441b260626. The vulnerability arises because the _readHttpParam function copies an HTTP query string into a fixed-size stack buffer without verifying the input size or guaranteeing NUL termination. This leads to memory corruption when parse_query_string processes attacker-controlled data. An unauthenticated remote attacker can exploit this by sending an oversized GET request to dispatcher.cgi, causing denial of service and potentially triggering memory corruption in the web management interface.

An unauthenticated remote attacker can cause denial of service of the web management interface and potentially trigger memory corruption, which may lead to instability or crashes of the device. The vulnerability does not require authentication and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the web management interface to trusted networks and monitor for unusual oversized HTTP requests targeting dispatcher.cgi.