CyberRota Analysis
AI-GeneratedThe web management interface of PLANET GS-4210-16P2S firmware versions prior to 3.441b260626 is vulnerable to a pre-authentication memory corruption issue due to improper handling of oversized HTTP query strings. This flaw allows unauthenticated remote attackers to exploit the vulnerability by sending crafted GET requests, potentially leading to denial of service and memory corruption. Organizations using this firmware should prioritize patching to mitigate the risk of exploitation.
Original NVD Description
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to dispatcher.cgi to cause denial of service of the web management interface and potentially trigger memory corruption.