The vulnerability is a stack buffer overflow in several POST handlers of dispatcher.cgi. It allows a remote attacker who can authenticate to the device to send crafted POST requests that copy data into fixed‑size buffers without length validation. This can terminate the CGI process or the entire web management service, causing a denial of service. The weakness is classic stack corruption (CWE‑121).

Affected devices are PLANET Technology Corp.’s GS‑4210‑16P2S routers that run firmware versions earlier than 3.441b260626. No other product versions are listed. The attack is performed via the web interface’s dispatcher.cgi using the enumerated handlers.

The CVSS score is 6.9, indicating a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Because authentication is required, the attack vector is remote‑authenticated. If an attacker obtains valid credentials, they can trigger the overflow and cause a service crash, leading to downtime. The absence of a publicly known exploit does not mitigate the risk, as the logic is straightforward and could be abused through credential compromise. Network isolation or stronger authentication increases the barrier to exploitation.