CVE-2026-75124 - PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to dispatcher.cgi to cause denial of service of the web manageme - 漏洞详情

漏洞编号：CVE-2026-75124

风险等级：高危

漏洞来源：CVE

CVE 编号：CVE-2026-75124

CNNVD 编号：-

厂商/产品：- / -

影响范围：-

CWE：CWE-120

发布/更新时间：2026-08-28 / 2026-08-28

漏洞描述

PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to dispatcher.cgi to cause denial of service of the web management interface and potentially trigger memory corruption.

漏洞描述

相关链接

相关漏洞