Critical Stack-Based Buffer Overflow in PLANET GS-5220-8P2T2S Switch Firmware CVE-2026-109445 Patched
Two critical vulnerabilities affecting PLANET Technology's GS-5220-8P2T2S PoE+ switches have been discovered and patched in firmware version 3.2412b261022. The most severe, CVE-2026-109445 (CVSS 9.8), is a stack-based buffer overflow triggered by an oversized webstax_auth HTTP cookie, allowing an unauthenticated attacker to crash the web management panel and potentially gain full control, though remote code execution on real hardware is not confirmed yet. The second vulnerability, CVE-2026-2336 (CVSS 8.8), permits a low-privileged authenticated user to forge admin cookies by extracting a shared key from their own session cookie. These flaws primarily expose IP phones and cameras managed via the switch's web panel, commonly used by small businesses and schools. PLANET Technology has released patches and advises restricting web panel access to trusted local subnets and monitoring logs for suspicious activity. No exploitation in the wild has been reported so far.
Entenda a falha
A vulnerabilidade
Two flaws affect the web management interface of the PLANET GS-5220-8P2T2S PoE+ switch (Hardware Version 3.0, firmware v3.2412b251216; the articles name Microchip IStaX as part of the product). CVE-2026-109445 (CVSS 9.8) is a stack-based buffer overflow: an unauthenticated remote attacker who can reach the web panel and sends an oversized webstax_auth cookie can crash it and potentially take control. PLANET says remote code execution on physical hardware is not confirmed. CVE-2026-2336 (CVSS 8.8) lets a low-privileged authenticated user pull a shared key from their own session cookie and forge an admin cookie. Both are fixed in firmware v3.2412b261022. One line in the article says 3.2412b261008, but the rest of the text and the story say 261022.
Como funciona
The web management panel reads the webstax_auth HTTP cookie sent with requests. In the overflow case, an unusually long cookie value is copied into a fixed-size buffer on the stack, and the excess data overwrites a saved return address in memory. In the researchers' QEMU tests this crashed the web panel. For the second flaw, the session cookie carries material from a key shared across sessions. A logged-in low-privileged user can extract that key from their own cookie and use it to build a cookie that the switch accepts as an administrator's.
Por que é vulnerável
For CVE-2026-109445, the cookie value is not checked against the size of the stack buffer that receives it, so oversized input corrupts adjacent memory. For CVE-2026-2336, session cookies are protected by a key shared between sessions, so a low-privileged user's own cookie exposes what is needed to forge another user's. The articles do not describe the code-level fix, only that firmware v3.2412b261022 resolves both issues.
Como foi descoberta
According to the article, Tianchang Yang and Syed Rafiul Hussain of Penn State University found both flaws. PLANET Technology then published a security advisory with patch steps, and said it tested firmware v3.2412b261022 on real hardware with a PASS result. The articles report no exploitation in the wild.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The article says that in QEMU tests the oversized cookie crashed the web panel, so a crash-level demonstration exists, but the articles do not say who holds it or that it was released. They state that no public exploit code has been confirmed and that code execution on real hardware is unconfirmed. Urgency comes mainly from the unauthenticated, network-reachable crash and the 9.8 score, so patch and restrict panel access.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 23:15.
Linha do tempo
-
Critical Stack-Based Buffer Overflow in PLANET GS-5220-8P2T2S Switch Firmware CVE-2026-109445 Patched
ler a análise desta fonte ocultar
Two critical vulnerabilities affecting PLANET Technology's GS-5220-8P2T2S PoE+ switches have been discovered and patched in firmware version 3.2412b261022. The most severe, CVE-2026-109445 (CVSS 9.8), is a stack-based buffer overflow triggered by an oversized webstax_auth HTTP cookie, allowing an unauthenticated attacker to crash the web management panel and potentially gain full control, though remote code execution on real hardware is not confirmed yet. The second vulnerability, CVE-2026-2336 (CVSS 8.8), permits a low-privileged authenticated user to forge admin cookies by extracting a shared key from their own session cookie. These flaws primarily expose IP phones and cameras managed via the switch's web panel, commonly used by small businesses and schools. PLANET Technology has released patches and advises restricting web panel access to trusted local subnets and monitoring logs for suspicious activity. No exploitation in the wild has been reported so far.