CVE-2026-81945
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Stack-based buffer overflow in the web server of PLANET IGS-5225-8P2T4S industrial managed switch firmware versions V1 and V2 before 1.2412b260707 and 2.2412b260519. Insufficient bounds checking on data copied into a stack buffer allows a remote administrator to cause a denial of service or potentially execute arbitrary code on the underlying operating system.
Risk Assessment
Risk includes disruption of switch operation (DoS) and potential full device compromise by a remote administrator, which can lead to network integrity breach.
Recommendation
Update the switch firmware to version 1.2412b260707 (V1) or 2.2412b260519 (V2) or later to eliminate the vulnerability.
Other vulnerabilities in PLANET IGS-5225-8P2T4S
See all- CVE-2026-81946Medium
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access password.
- CVE-2026-81944High
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote authenticated attacker to cause a denial of service or potentially execute arbitrary code on the underlying operating system.
- CVE-2026-81943Medium
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded software. An attacker with privileged access to the device can enable this debug mode to execute arbitrary code on the underlying operating system and gain root-level access.
- CVE-2026-81942High
PLANET IGS-5225-8P2T4S industrial managed switch (firmware V1 and V2 before 1.2412b260707 and 2.2412b260519) contains an OS command injection vulnerability in the web server. User-supplied input is passed to system() without sufficient filtering, allowing a remote authenticated attacker to execute arbitrary commands on the underlying OS and escalate privileges to root.
Original NVD description (English source)
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote administrator to cause a denial of service or potentially execute arbitrary code on the underlying operating system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS