The vulnerability is an authenticated stack buffer overflow in the dispatcher.cgi web application of the PLANET GS-4210-16P2S device. The web_login_first_post, web_sys_enablePasswd_post, and web_sys_localUser_post handlers copy user‑supplied POST parameters into fixed‑size stack buffers without performing length validation. This flaw can be triggered by a remote attacker who has authenticated to the web interface, allowing the attacker to send a crafted request that corrupts the stack and causes the CGI process or web management service to crash. The resulting denial of service could render the device unusable or force administrators to reboot the system. The weakness is a classic stack buffer overflow (CWE‑121).

The flaw exists in PLANET Technology Corp.’s PLANET GS-4210-16P2S device, specifically in firmware versions prior to 3.441b260626. Devices running this firmware are susceptible to the described stack buffer overflow when exposed to authenticated web interface traffic. No other versions or firmware releases are listed as affected.

The CVSS base score of 6.9 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires a remote authenticated user, meaning an attacker must first gain valid credentials to the web management interface. Once authenticated, the attacker can craft requests that overflow the stack buffers, crash the process, and trigger a denial of service. Given the lack of publicly known exploits and the requirement for authentication, the likelihood of widespread exploitation remains moderate but not negligible for targeted attacks.