CVE-2026-77217

Name of the Vulnerable Software and Affected Versions PLANET GS-4210-16P2S versions prior to 3.441b260626

Description Authenticated stack buffer overflow and null pointer dereference issues exist in the '/cgi-bin/dispatcher.cgi' endpoint. The web radiusSrv* post family of handlers copies the radKey, radKey 0, radDftParamKey, radName, and radIp POST parameters into fixed-size stack buffers without validating their length. Furthermore, the system dereferences radName and radIp without verifying if they are present in the request. A remote authenticated attacker can exploit these flaws by sending crafted requests to crash the CGI process or the web management service, leading to a denial of service.

Recommendations Update PLANET GS-4210-16P2S to version 3.441b260626 or later.