CVE-2026-81942
HighCVSS 8.8Summary
PLANET IGS-5225-8P2T4S industrial managed switch (firmware V1 and V2 before 1.2412b260707 and 2.2412b260519) contains an OS command injection vulnerability in the web server. User-supplied input is passed to system() without sufficient filtering, allowing a remote authenticated attacker to execute arbitrary commands on the underlying OS and escalate privileges to root.
Risk Assessment
An attacker can gain full control of the device, potentially compromising network integrity, intercepting data, or disrupting infrastructure operations.
Recommendation
Update the switch firmware to a patched version (1.2412b260707 or later for V1, 2.2412b260519 or later for V2). Restrict access to the management interface to trusted networks only.
Other vulnerabilities in PLANET IGS-5225-8P2T4S
See all- CVE-2026-81946Medium
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access password.
- CVE-2026-81945Medium
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote administrator to cause a denial of service or potentially execute arbitrary code on the underlying operating system.
- CVE-2026-81944High
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote authenticated attacker to cause a denial of service or potentially execute arbitrary code on the underlying operating system.
- CVE-2026-81943Medium
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded software. An attacker with privileged access to the device can enable this debug mode to execute arbitrary code on the underlying operating system and gain root-level access.
Original NVD description (English source)
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system() without sufficient filtering, allowing a remote authenticated attacker to execute arbitrary commands on the underlying operating system and escalate privileges to root.