Maksim Gruzin

**Name of the Vulnerable Software and Affected Versions** PLANET IGS-5225-8P2T4S V1 versions prior to 1.2412b260707 PLANET IGS-5225-8P2T4S V2 versions prior to 2.2412b260519 **Description** The web server contains an OS command injection flaw where user-supplied input is passed to the `system()` function without sufficient filtering. This allows a remote authenticated attacker to execute arbitrary commands on the underlying operating system and escalate privileges to root. **Recommendations** Update PLANET IGS-5225-8P2T4S V1 to version 1.2412b260707 or later. Update PLANET IGS-5225-8P2T4S V2 to version 2.2412b260519 or later.

**Name of the Vulnerable Software and Affected Versions** PLANET IGS-5225-8P2T4S V1 versions prior to 1.2412b260707 PLANET IGS-5225-8P2T4S V2 versions prior to 2.2412b260519 **Description** The embedded software contains active debug functionality. An attacker with privileged access to the device can enable this debug mode to execute arbitrary code on the underlying operating system and obtain root-level access. **Recommendations** Update V1 to version 1.2412b260707 or later. Update V2 to version 2.2412b260519 or later.

**Name of the Vulnerable Software and Affected Versions** PLANET IGS-5225-8P2T4S V1 versions prior to 1.2412b260707 PLANET IGS-5225-8P2T4S V2 versions prior to 2.2412b260519 **Description** A stack-based buffer overflow exists in the web server due to insufficient bounds checking on data copied into a stack buffer. This allows a remote authenticated attacker to cause a denial of service or potentially execute arbitrary code on the underlying operating system. **Recommendations** Update V1 to version 1.2412b260707 or later. Update V2 to version 2.2412b260519 or later.

**Name of the Vulnerable Software and Affected Versions** PLANET IGS-5225-8P2T4S V1 versions prior to 1.2412b260707 PLANET IGS-5225-8P2T4S V2 versions prior to 2.2412b260519 **Description** A stack-based buffer overflow exists in the web server due to insufficient bounds checking on data copied into a stack buffer. This allows a remote administrator to cause a denial of service or potentially execute arbitrary code on the underlying operating system. **Recommendations** Update V1 to version 1.2412b260707 or later. Update V2 to version 2.2412b260519 or later.

**Name of the Vulnerable Software and Affected Versions** PLANET IGS-5225-8P2T4S V1 versions prior to 1.2412b260707 PLANET IGS-5225-8P2T4S V2 versions prior to 2.2412b260519 **Description** The device uses MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access password. **Recommendations** Update PLANET IGS-5225-8P2T4S V1 to version 1.2412b260707 or later. Update PLANET IGS-5225-8P2T4S V2 to version 2.2412b260519 or later.