CVE-2026-109445 · Infrastructure
NO FIX YET · SEE WHAT TO DO
PLANET GS-5220-8P2T2S switches (hardware version 3.0) with firmware before 3.2412b261008 have a stack buffer overflow in the webstax_auth cookie handling. An unauthenticated attacker can send an oversized cookie over HTTP to corrupt stack memory, causing crashes or potential code execution on the device.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running PLANET GS-5220-8P2T2S switches with hardware version 3.0 and firmware older than 3.2412b261008 are exposed, especially where the web management interface is reachable from untrusted networks. Switches on isolated management networks with no HTTP exposure carry less risk, and devices already on the fixed firmware are not affected.
Not affected if fixed-firmware, management-isolated
Who cares firmware, gs-5220-8p2t2s, network-switch, planet
3.2412b261008.3.0 on the device label or system information.3.2412b261008 or later.PLANET GS-5220-8P2T2S (hardware version 3.0) firmware versions before 3.2412b261008 contains a stack-based buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by submitting an oversized webstax_auth HTTP Cookie value that is copied into a fixed-size stack buffer without length validation. Attackers can send a crafted unauthenticated HTTP request with an oversized cookie to overwrite the saved return address and corrupt stack memory, leading to memory corruption and potential denial of service on the device.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.