CVE-2026-109445 (CVSS 9.8): PLANET GS-5220-8P2T2S V3 Stack-Based Buffer Overflow Fixed
Do Son 
TL;DR
PLANET Technology patched two PLANET GS-5220-8P2T2S vulnerabilities in firmware v3.2412b261022. These bugs let attackers crash the web panel or gain full admin rights via HTTP cookies. IT teams must update their switches and block untrusted web access right away.
- Product: PLANET Technology Corp. PLANET GS-5220-8P2T2S, Microchip IStaX
- Vulnerabilities: 2 flaws (CVE-2026-109445, CVE-2026-2336)
- Highest severity: 9.8 (Critical · CVSSv3)
- Worst impact: Stack Buffer Overflow via webstax_auth Cookie
- Status: No confirmed exploitation yet; patches available
- Action: Update to 3.2412b261008, 2026.03 now
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-109445 | 9.8 | Stack Buffer Overflow via webstax_auth Cookie | 3.2412b261008 | Not exploited |
| CVE-2026-2336 | 8.7 | Weak webstax_auth Cookie Authentication Allows Privilege Escalation | 2026.03 | Not exploited |
Why It Matters
Small firms and schools run IP phones and cameras on the PLANET GS-5220-8P2T2S PoE+ switch. Thus, bugs in its web panel put core networks at high risk. Tianchang Yang and Syed Rafiul Hussain at Penn State University found both flaws. Later, the vendor posted a PLANET Technology security advisory with patch steps. Currently, no live attacks in the wild or public exploit code have been confirmed.
How the Attack Works
CVE-2026-109445: Stack-Based Buffer Overflow
First, CVE-2026-109445 holds a 9.8 CVSS v3.1 score. The advisory notes, “In affected firmware, an unauthenticated remote attacker can trigger a stack-based buffer overflow by supplying an oversized webstax_auth HTTP Cookie value to the web management interface.” Next, the long cookie overwrites a saved return address in RAM. In QEMU tests, this crash broke the web panel. However, PLANET adds, “Remote code execution on physical hardware has not been confirmed.”
CVE-2026-2336: Session Cookie Forgery
Second, CVE-2026-2336 carries an 8.8 CVSS v3.1 score. A logged-in user with low rights can pull a shared key from their own cookie. Afterward, that user can forge an admin cookie. Still, PLANET notes, “This issue requires an authenticated low-privileged user and is not an unauthenticated attack.”
Affected Versions
Impacted Switch Hardware
These PLANET GS-5220-8P2T2S vulnerabilities hit Hardware Version 3.0 on firmware v3.2412b251216. Other unpatched builds may also face risk.
Patch and Mitigation Steps
Luckily, PLANET tested firmware v3.2412b261022 on real hardware and confirmed a PASS result. Thus, admins must get v3.2412b261022 from the main PLANET site and flash their switches. Finally, teams should lock the web panel to trusted local subnets and check switch logs for odd logins.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
