Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
PLANET GS-4210-16P2S firmware contains an authenticated OS command injection vulnerability in the /cgi-bin/dispatcher.cgi endpoint. The web_vlan_membership_edit_dialog_post handler fails to sanitize the memberTags POST parameter before incorporating it into a shell command, allowing arbitrary command execution.
An authenticated attacker with high privileges can send a crafted memberTags POST parameter to execute arbitrary operating system commands on the device with the privileges of the web server process.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Yes, a patch is available. Firmware version 3.441b260626 and later address this vulnerability.
Update PLANET GS-4210-16P2S firmware to version 3.441b260626 or later. Additionally, restrict network access to the device's web management interface to trusted administrators only and implement network segmentation to limit exposure of management interfaces.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD published the first details for CVE-2026-75121
A CVSS base score of 7.2 has been assigned.
Feedly found the first article mentioning CVE-2026-75121 . See article
GitHub Advisories released a security advisory .
CVE-2026-75121 - Exploits & Severity - Feedly
CVE-2026-75121 | PLANET Technology PLANET GS-4210-16P2S up to 3.441b260625 Dispatcher /cgi-bin/dispatcher.cgi web_vlan_membership_edit_dialog_post memberTags os command injection
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
