CVE-2026-77218: Stack-based Buffer Overflow in PLANET Technology Corp. PLANET GS-4210-16P2S V3

The PLANET GS-4210-16P2S V3 device firmware prior to version 3.441b260626 is affected by multiple stack-based buffer overflow vulnerabilities in the web management interface's /cgi-bin/dispatcher.cgi endpoint. Specifically, the web_login_first_post handler copies the usrPass POST parameter, the web_sys_enablePasswd_post handler copies the enbPass POST parameter, and the web_sys_localUser_post handler copies both usrName and usrPass POST parameters into fixed-size stack buffers without validating their length. This lack of bounds checking enables an authenticated remote attacker to send specially crafted requests that overflow these buffers, leading to a crash of the CGI process or the web management service, resulting in denial of service. The vulnerabilities require authentication and do not involve user interaction or complex attack conditions. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

Successful exploitation allows an authenticated remote attacker to cause a denial of service by crashing the CGI process or the web management service on the affected device. This disrupts normal device management and may impact network operations relying on the device. There is no indication of code execution or data disclosure from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's web management interface to trusted administrators only and monitor for unusual crashes or service interruptions. No vendor-provided mitigation or temporary fix is currently documented.