SECURITYCRITICALCVE-2026-109445

CVE-2026-109445: PLANET GS-5220-8P2T2S Stack Buffer Overflow via webstax_auth Cookie (CVSS 9.8)

PLANET GS-5220-8P2T2S v3.0 firmware before 3.2412b261008 has an unauthenticated stack overflow via an oversized webstax_auth cookie. CVSS 9.8.

Dylan H.

Security Team

November 14, 2026
2 min read
CVE-2026-109445: PLANET GS-5220-8P2T2S Stack Buffer Overflow via webstax_auth Cookie (CVSS 9.8)

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • PLANET GS-5220-8P2T2S (hardware version 3.0) firmware before 3.2412b261008

Summary

CVE-2026-109445 is a stack-based buffer overflow in the web interface of the PLANET GS-5220-8P2T2S switch (hardware version 3.0). It was published to NVD on November 13, 2026 with a CVSS score of 9.8.

Details

Firmware versions before 3.2412b261008 copy the value of the webstax_auth HTTP Cookie into a fixed-size stack buffer without a length check. An unauthenticated attacker who sends an oversized cookie can corrupt stack memory.

ItemDetail
CVECVE-2026-109445
CVSS9.8 (critical)
ProductPLANET GS-5220-8P2T2S, hardware version 3.0
AffectedFirmware before 3.2412b261008
AuthenticationNone required

Stack corruption in an embedded device can lead at minimum to a crash and denial of service, and potentially to remote code execution. NVD does not list public exploitation, and the feed data does not say whether code execution has been demonstrated.

Recommended actions

  1. Upgrade affected switches to firmware 3.2412b261008 or later from PLANET.
  2. Do not expose the switch management interface to the internet; restrict it to a dedicated management VLAN.
  3. Limit web management access to trusted admin hosts with ACLs.
  4. Monitor for unusually long Cookie headers sent to the management interface.

References