A pre‑authentication memory corruption flaw resides in the web management interface of PLANET GS‑4210‑16P2S firmware versions before 3.441b260626. The vulnerability is triggered when the _readHttpParam function copies an oversized HTTP query string passed to dispatcher.cgi without guaranteeing NUL termination. The unbounded string is then parsed by parse_query_string into a fixed‑size stack buffer, allowing a remote attacker to craft a GET request that overflows the buffer. The result can be a denial of service of the management interface and, depending on the memory layout, potential memory corruption.

PLANET Technology Corp. offers the PLANET GS‑4210‑16P2S device. Firmware versions prior to 3.441b260626 are affected; the vulnerability exists in the device’s web interface component dispatcher.cgi.

The CVSS score of 8.7 indicates a high severity of the flaw. The EPSS score of 0.00484 indicates a very low exploitation probability, but the absence of a KEV listing does not reduce the risk for exposed devices. The attack requires no authentication and can be performed from any network that can reach the device’s web interface, making it a remote vulnerability that can be leveraged by attackers with minimal effort. The high severity and wide accessibility justify prompt remediation.