Authenticated OS Command Injection Vulnerability in PLANET GS-4210-16P2S Firmware

cve.report

Authenticated OS Command Injection Vulnerability in PLANET GS-4210-16P2S Firmware

First seen 30 Aug 2026, 09:47 UTC • •57.0

Article Content

1 / 5

Browse articles

ThreatCluster •August 31, 2026 at 09:47 UTC

•CVE-2026-75121 affects PLANET GS-4210-16P2S firmware before version 3.441b260626.
•The vulnerability allows authenticated attackers to execute arbitrary OS commands.
•A patch is available, and users are urged to update their firmware immediately.

CVE-2026-75121 is an authenticated OS command injection vulnerability found in the PLANET GS-4210-16P2S firmware, specifically in the /cgi-bin/dispatcher.cgi endpoint. The vulnerability arises from the failure to properly sanitize the memberTags POST parameter, allowing authenticated attackers with high privileges to execute arbitrary commands on the device. Currently, there is no evidence of public proof-of-concept or confirmed exploitation in the wild. A patch has been released, and users are advised to update to firmware version 3.441b260626 or later. Additionally, restricting network access to the device's web management interface is recommended to mitigate risks. The CVSS base score assigned to this vulnerability is 7.2, indicating a high severity level. The vulnerability was published on August 28, 2026, and has been reported by multiple sources.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 49d ago How this analysis works

Timeline

2026-08-28

CVE-2026-75121 published

PLANET Technology disclosed an OS command injection vulnerability in their GS-4210-16P2S firmware.

2026-08-29

First reports of vulnerability details

Feedly published the first details regarding CVE-2026-75121, including its severity and impact.

2026-08-30

CVE vulnerability disclosures reported

cve.report provided additional details on the vulnerability and its potential impact on users.

More articles in this cluster (4)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Zero-day Exploit
T1059 - Command and Scripting Interpreter

Vulnerability (2)

CVE-2026-75121
OS Command Injection

Weakness (1)

CWE-78 - OS Command Injection

Affected Platform (1)

Planet Gs-4210-16p2s Firmware

Relationships

CVE-2026-75121 targets Planet Gs-4210-16p2s Firmware
OS Command Injection targets Planet Gs-4210-16p2s Firmware
Zero-day Exploit targets Planet Gs-4210-16p2s Firmware
T1059 - Command and Scripting Interpreter targets Planet Gs-4210-16p2s Firmware
CVE-2026-75121 related to CWE-78 - OS Command Injection

Following this threat?

Track CVE-2026-75121 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Langflow Exposed CVE-2026-105740 is a critical remote code execution (RCE) vulnerability affecting Langflow versions prior to 1.9.0. Authenticated users can exploit this flaw by adding an MCP server with the 'Stdio' transport, allowing arbitrary OS commands to be executed without validation. The vulnerability was published on October…

OS Command Injection Flaw in SiteGuard WAF Exploited EG Secure Solutions disclosed that attackers are exploiting an OS command injection vulnerability in SiteGuard Server Edition, tracked as CVE-2026-106931. This flaw allows attackers to execute commands with root or SYSTEM privileges, affecting versions 2.20 and later, with the statistics feature enabled by default.…