External risk intelligence

PLANET GS-5220-8P2T2S Firmware Stack Buffer Overflow via Web Authentication Cookie

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-109445

The vulnerability affects a network switch device that exposes a web management interface. These devices are commonly deployed at the edge of networks and, while often intended for internal management, frequently possess interfaces that are reachable over the network or exposed to the public internet in many deployment scenarios.

Buffer Overflow

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the firmware of certain PLANET network devices, specifically impacting the web management interface. This issue allows unauthenticated attackers to potentially disrupt device operations by exploiting an improperly handled HTTP cookie. The main concern is to confirm if these devices are in use and if they are exposed to potential threats.

Network devices can be disrupted by unauthorized users.
Confirms use and exposure of network switches.
Assess potential impact on network device operations.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component by sending a specially crafted HTTP request over the network to the device's web interface. Because the vulnerability does not require authentication or user interaction, an unauthenticated attacker can exploit it directly. This allows them to corrupt memory, which can lead to a denial of service.

No authentication needed.
Oversized HTTP cookie triggers overflow.
Risk of memory corruption and denial of service.

Live Threat

Current exploitation, exposure, and threat context

A stack-based buffer overflow vulnerability in the web management interface could allow unauthenticated attackers to corrupt memory by submitting a crafted HTTP request. This could lead to denial of service when the device is accessed via its web interface.

Device memory corruption.
Oversized HTTP cookie submission.
Potential denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PLANET GS-5220-8P2T2S hardware is likely managed by network or infrastructure teams responsible for device uptime and security. The immediate first step is to confirm the presence and network exposure of these devices, identify their business criticality, and then locate the accountable owner to plan remediation, which may involve vendor coordination or temporary risk reduction measures.

Network or infrastructure teams should own.
Verify device reachability and business criticality.
Plan vendor-coordinated remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the PLANET GS-5220-8P2T2S?

The PLANET GS-5220-8P2T2S is a managed network switch designed to provide high-performance connectivity for business environments. It includes an integrated web-based management interface that allows administrators to configure network settings, monitor port traffic, and manage security policies directly through a browser.

How does this buffer overflow work in CVE-2026-109445?

This vulnerability is a stack-based buffer overflow, classified as CWE-121. It occurs because the device's web management software fails to check the size of data provided in a specific HTTP cookie. When an attacker sends an exceptionally large 'webstax_auth' cookie, the software attempts to write this data into a memory space that is too small, causing the extra data to overwrite critical memory instructions.

What specifically triggers this CVE-2026-109445 vulnerability?

The vulnerability is triggered when an attacker sends a malicious HTTP request to the web interface containing an oversized 'webstax_auth' cookie value. Notably, this flaw does not require the attacker to have valid login credentials or interact with a legitimate user; it can be initiated by any unauthenticated entity capable of reaching the device's web management service over the network.

Is my device at risk based on Halo Surface Signal?

According to Halo Surface Signal, these switches are often placed at network edges and frequently have web management interfaces reachable over the network. If your device is accessible from the internet or even widely accessible across your internal network, it is at higher risk. The primary concern is unauthorized access to a management interface that should ideally be strictly restricted.

How should I respond to this PLANET firmware issue?

Start by identifying all instances of this specific switch model within your infrastructure and determining if their web management interfaces are accessible over the network. Once located, coordinate with the infrastructure team to restrict access to these management ports, ideally by placing them on a management-only VLAN or implementing firewall rules to limit who can reach the interface until a firmware update can be applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.