A locally unknown function, sub_40C8E4, in the Planet ICG-2510 Language Package Configuration Handler, is susceptible to a stack-based buffer overflow when an attacker manipulates the argument Language. The overflow can overwrite memory on the server stack and potentially allow arbitrary code execution. The CVE description confirms that the attack can be launched remotely and that the vendor has not provided a fix. The vulnerability is classified under CWEs 119 and 121, indicating improper bounds checking and potential stack corruption.

The affected product is Planet ICG-2510, version 1.0_20250811. Users running this firmware on their HTTPd service are at risk if the Language Package Configuration Handler is enabled. No additional versions or environments are known to be affected at this time.

The CVSS base score for this issue is 5.3, reflecting moderate severity. EPSS indicates a very low exploitation probability (<1%) and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the remote nature of the trigger and the possibility of arbitrary code execution give the attacker significant impact potential. Exploitation requires sending a crafted request containing an overly large Language argument to the httpd service. It does not rely on any additional preconditions beyond network reachability to the vulnerable handler.