The vulnerability is an authenticated stack buffer overflow in the dispatcher.cgi web application of the PLANET GS-4210-16P2S device. The web_login_first_post handler copies the usrPass POST parameter into a fixed-size stack buffer without length validation, the web_sys_enablePasswd_post handler copies the enbPass POST parameter into a fixed-size stack buffer without length validation, and the web_sys_localUser_post handler copies the usrName and usrPass POST parameters into fixed-size stack buffers without length validation. A remote authenticated attacker can send a crafted request to crash the CGI process or web management service, resulting in denial of service. The weakness is a classic stack buffer overflow (CWE‑121).

The flaw exists in PLANET Technology Corp.’s PLANET GS-4210-16P2S device, specifically in firmware versions prior to 3.441b260626. Devices running this firmware are susceptible to the described stack buffer overflow when exposed to authenticated web interface traffic. No other versions or firmware releases are listed as affected.

The CVSS base score of 6.9 indicates a moderate severity. EPSS score is 0.00411 (<1%), and the vulnerability is not listed in the CISA KEV catalog. The exploit requires a remote authenticated user, meaning an attacker must first gain valid credentials to the web management interface. Once authenticated, the attacker can craft requests that overflow the stack buffers, crash the process, and trigger a denial of service. Given the lack of publicly known exploits and the requirement for authentication, the likelihood of widespread exploitation remains moderate but not negligible for targeted attacks.