{"id":"CVE-2026-109445","kind":"vulnerability","aliases":["CVE-2026-109445"],"related":[],"title":"PLANET GS-5220 switch: oversized cookie overflows stack, unauthenticated attackers","description":"PLANET GS-5220-8P2T2S (hardware version 3.0) firmware versions before 3.2412b261008 contains a stack-based buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by submitting an oversized webstax_auth HTTP Cookie value that is copied into a fixed-size stack buffer without length validation. Attackers can send a crafted unauthenticated HTTP request with an oversized cookie to overwrite the saved return address and corrupt stack memory, leading to memory corruption and potential denial of service on the device.","summary":"PLANET GS-5220-8P2T2S switches (hardware version 3.0) with firmware before 3.2412b261008 have a stack buffer overflow in the webstax_auth cookie handling. An unauthenticated attacker can send an oversized cookie over HTTP to corrupt stack memory, causing crashes or potential code execution on the device.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firmware","gs-5220-8p2t2s","infrastructure","network-switch","planet"],"not_affected_if":["fixed-firmware","management-isolated"],"how_to_check":"- Check the firmware version in the switch's web management interface or system information page; compare it with `3.2412b261008`.\n- Confirm the hardware version is `3.0` on the device label or system information.\n- Check whether the web management interface is reachable from untrusted networks.","fix":"- PLANET GS-5220-8P2T2S hardware version 3.0: firmware `3.2412b261008` or later.","status":"open","published_at":"2026-11-13T15:17:30+00:00","first_seen_at":"2026-11-13T15:46:15+00:00","triaged_at":"2026-11-13T15:48:07+00:00","updated_at":"2026-11-13T15:48:07+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T15:48:07Z","model":"claude-haiku-5-5","output":{"fix":"- PLANET GS-5220-8P2T2S hardware version 3.0: firmware `3.2412b261008` or later.","reach":"network","title":"PLANET GS-5220 switch: oversized cookie overflows stack, unauthenticated attackers","impact":"high","summary":"PLANET GS-5220-8P2T2S switches (hardware version 3.0) with firmware before 3.2412b261008 have a stack buffer overflow in the webstax_auth cookie handling. An unauthenticated attacker can send an oversized cookie over HTTP to corrupt stack memory, causing crashes or potential code execution on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["planet","gs-5220-8p2t2s","network-switch","firmware"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attacker corrupts device memory, causing denial of service or code execution","analyst_note":"Confirm whether the fixed firmware is the only fix and whether exploitation beyond denial of service is demonstrated; check the vendor's PLANET advisory for the fix source.","how_to_check":"- Check the firmware version in the switch's web management interface or system information page; compare it with `3.2412b261008`.\n- Confirm the hardware version is `3.0` on the device label or system information.\n- Check whether the web management interface is reachable from untrusted networks.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-firmware","management-isolated"],"who_is_affected":"Organizations running PLANET GS-5220-8P2T2S switches with hardware version 3.0 and firmware older than 3.2412b261008 are exposed, especially where the web management interface is reachable from untrusted networks. Switches on isolated management networks with no HTTP exposure carry less risk, and devices already on the fixed firmware are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000817,"input_tokens":4681,"output_tokens":698,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-109445':13A,16A '-2026':12A,15A '-5220':3A,19B,29B,77C '-8':20B,30B,78C '3.0':35B,82C '3.2412':39B,86C 'address':143C 'allow':97C 'attack':10A,54B,99C,126C 'auth':49B,109C 'b261008':40B,87C 'base':92C 'buffer':44B,93C,122C 'caus':66B 'code':70B 'contain':88C 'cooki':6A,50B,59B,111C,137C 'copi':115C 'corrupt':63B,101C,145C,151C 'craft':130C 'crash':67B 'cve':11A,14A 'denial':154C 'devic':74B,159C 'execut':71B 'firmwar':17B,37B,83C 'fix':119C 'fixed-s':118C 'gs':2A,18B,28B,76C 'handl':51B 'hardwar':33B,80C 'http':61B,110C,132C 'infrastructur':22B 'lead':148C 'length':124C 'memori':65B,103C,147C,150C 'network':24B 'network-switch':23B 'overflow':7A,45B,94C 'overs':5A,58B,107C,136C 'overwrit':139C 'p2t2s':21B,31B,79C 'planet':1A,26B,27B,75C 'potenti':69B,153C 'request':133C 'return':142C 'save':141C 'send':56B,128C 'servic':156C 'size':120C 'stack':8A,43B,64B,91C,102C,121C,146C 'stack-bas':90C 'submit':105C 'switch':4A,25B,32B 'unauthent':9A,53B,98C,131C 'valid':125C 'valu':112C 'version':34B,81C,84C 'vulner':95C 'webstax':48B,108C 'without':123C","nicknames":[],"mitigations":[],"who_affected":"Organizations running PLANET GS-5220-8P2T2S switches with hardware version 3.0 and firmware older than 3.2412b261008 are exposed, especially where the web management interface is reachable from untrusted networks. Switches on isolated management networks with no HTTP exposure carry less risk, and devices already on the fixed firmware are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","firmware","gs52208p2t2s","infrastructure","networkswitch","planet"],"campaign_type":null,"search_a":"'-109445':13A,16A '-2026':12A,15A '-5220':3A 'attack':10A 'cooki':6A 'cve':11A,14A 'gs':2A 'overflow':7A 'overs':5A 'planet':1A 'stack':8A 'switch':4A 'unauthent':9A","search_b":"'-5220':19B,29B '-8':20B,30B '3.0':35B '3.2412':39B 'attack':54B 'auth':49B 'b261008':40B 'buffer':44B 'caus':66B 'code':70B 'cooki':50B,59B 'corrupt':63B 'crash':67B 'devic':74B 'execut':71B 'firmwar':17B,37B 'gs':18B,28B 'handl':51B 'hardwar':33B 'http':61B 'infrastructur':22B 'memori':65B 'network':24B 'network-switch':23B 'overflow':45B 'overs':58B 'p2t2s':21B,31B 'planet':26B,27B 'potenti':69B 'send':56B 'stack':43B,64B 'switch':25B,32B 'unauthent':53B 'version':34B 'webstax':48B","search_c":"'-5220':77C '-8':78C '3.0':82C '3.2412':86C 'address':143C 'allow':97C 'attack':99C,126C 'auth':109C 'b261008':87C 'base':92C 'buffer':93C,122C 'contain':88C 'cooki':111C,137C 'copi':115C 'corrupt':101C,145C,151C 'craft':130C 'denial':154C 'devic':159C 'firmwar':83C 'fix':119C 'fixed-s':118C 'gs':76C 'hardwar':80C 'http':110C,132C 'lead':148C 'length':124C 'memori':103C,147C,150C 'overflow':94C 'overs':107C,136C 'overwrit':139C 'p2t2s':79C 'planet':75C 'potenti':153C 'request':133C 'return':142C 'save':141C 'send':128C 'servic':156C 'size':120C 'stack':91C,102C,121C,146C 'stack-bas':90C 'submit':105C 'unauthent':98C,131C 'valid':125C 'valu':112C 'version':81C,84C 'vulner':95C 'webstax':108C 'without':123C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109445","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109445","severity":null,"published_at":"2026-11-13T15:17:30+00:00","modified_at":"2026-11-13T15:17:30+00:00","first_seen_at":"2026-11-13T15:46:15+00:00","fetched_at":"2026-11-13T15:46:15+00:00","note":null}],"documents":[{"id":147255,"url":"https://www.vulncheck.com/advisories/planet-gs-5220-8p2t2s-stack-buffer-overflow-via-webstax-auth-cookie","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}