CVE-2026-81942: PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-18 · updated 2026-09-22
Weakness: CWE-78

Description

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system() without sufficient filtering, allowing a remote authenticated attacker to execute arbitrary commands on the underlying operating system and escalate privileges to root.

Affected products

PLANET Technology Corp. PLANET IGS-5225-8P2T4S V1: before 1.2412b260707 — fixed in 1.2412b260707
PLANET Technology Corp. PLANET IGS-5225-8P2T4S V2: before 2.2412b260519 — fixed in 2.2412b260519

How to fix

Upgrade to a fixed version: PLANET Technology Corp. PLANET IGS-5225-8P2T4S V1 1.2412b260707; PLANET Technology Corp. PLANET IGS-5225-8P2T4S V2 2.2412b260519. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-81942 or the next vulnerability affects your stack