PLANET Technology vulnerabilities
We track 21 vulnerabilities in PLANET Technology products across 15 products. 21 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest PLANET Technology vulnerabilities
- 9.8 Critical severity
PLANET GS-5220-8P2T2S: Stack-based Buffer Overflow
PLANET GS-5220-8P2T2S (hardware version 3.0) firmware versions before 3.2412b261008 contains a stack-based buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by submitting an oversized webstax_auth HTTP Cookie value tha
- 7.5 High severity
PLANET IGS-5225-8P2T4S V1: Stack-based Buffer Overflow
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote authent
- 8.8 High severity
PLANET IGS-5225-8P2T4S V1: Improper Neutralization of Special Elements used in an OS Command
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system() without sufficient filtering, allowin
- 7.5 High severity
PLANET GS-4210-16P2S V3: Buffer Copy without Checking Size of Input
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, all
- 7.2 High severity
PLANET GS-4210-16P2S V3: Improper Neutralization of Special Elements used in an OS Command
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handler incorporates a caller-supplied SMTP server value directly into a shell command without
- 7.2 High severity
PLANET GS-4210-16P2S V3: Improper Neutralization of Special Elements used in an OS Command
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without saniti
- 7.2 High severity
PLANET GS-4210-16P2S V3: Improper Neutralization of Special Elements used in an OS Command
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_vlan_membership_edit_dialog_post handler incorporates the memberTags POST parameter into a shell command witho
- 9.8 Critical severity
ICG-2510WG-LTE (EU/US): Improper Neutralization of Special Elements used in an OS Command
Certain models of Industrial Cellular Gateway developed by Planet Technology have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the device.
- 9.8 Critical severity
ICG-2510WG-LTE (EU/US): Missing Authentication for Critical Functionality
Certain models of Industrial Cellular Gateway developed by Planet Technology have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to manipulate the device via a specific functionality.
- 9.8 Critical severity
WGS-804HPT-V2: Missing Authentication for Critical Functionality
WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials.
- 9.8 Critical severity
UNI-NMS-Lite: Use of Hard-coded Credentials
UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices.
- 9.1 Critical severity
WGS-804HPT-V2: Improper Neutralization of Special Elements used in an OS Command
WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host system.
- 9.8 Critical severity
Planet WGS-804HPT: Improper Neutralization of Special Elements used in an OS Command
The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution.
- 9.8 Critical severity
Planet WGS-804HPT: Stack-based Buffer Overflow
The affected product is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that the webserver fails to properly check input size before copying data to the stack, potentially allowing remote code execut
- 8.8 High severity
GS-4210-24PL4C hardware 2.0: Cross-Site Request Forgery
Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker can trick a user into visiting a malicious website, allowing the attacker to impersonate the user an
- 9.8 Critical severity
GS-4210-24PL4C hardware 2.0: Missing Authentication for Critical Functionality
Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the d
- 7.5 High severity
GS-4210-24PL4C hardware 2.0: Uncontrolled Resource Consumption
The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerability in the swctrl service, allowing unauthenticated remote attackers to send crafted packets that can crash the service
- 7.5 High severity
GS-4210-24PL4C hardware 2.0: Use of a Broken or Risky Cryptographic Algorithm
Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially.
- 7.5 High severity
GS-4210-24PL4C hardware 2.0: Improper Handling of Insufficient Permissions or Privileges
Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorized remote attackers to exploit this weakness to occupy connection slots and prevent legitimate users f
- 9.8 Critical severity
GS-4210-24PL4C hardware 2.0: Use of Hard-coded Credentials
Certain switch models from PLANET Technology have a Hard-coded community string in the SNMPv1 service, allowing unauthorized remote attackers to use this community string to access the SNMPv1 service with read-write privileges.
- 8.8 High severity
GS-4210-24PL4C hardware 2.0: Use of Hard-coded Credentials
Certain switch models from PLANET Technology have a hard-coded credential in the specific command-line interface, allowing remote attackers with regular privilege to log in with this credential and obtain a Linux root shell.