PLANET fixes cookie flaws in its PoE switch

PLANET Technology has disclosed two vulnerabilities affecting the PLANET GS-5220-8P2T2S PoE+ switch, running hardware version 3.0 with firmware around 3.2412b251216. The flaws, tracked as CVE-2026-109445 and CVE-2026-2336, were identified by researchers at Penn State University. PLANET publicised a security advisory and released fixes in firmware 3.2412b261022 (with earlier builds noted as at risk).

In practice, the issues could let an unauthenticated remote attacker crash the web management panel by supplying an oversized webstax_auth cookie, or enable a logged-in user with low privileges to forge an admin cookie by harvesting a key from their own session cookie. PLANET cautions that remote code execution on physical hardware has not been confirmed, and notes that the second issue requires authentication and is not an unauthenticated exploit.

Evidence and impact are described in the vendor advisory and independent write-ups: CVE-2026-109445 carries a CVSS v3.1 score of 9.8 and is described as a stack-based buffer overflow via the webstax_auth cookie, potentially affecting the web panel and RAM, with no confirmed remote code execution on real devices. CVE-2026-2336 carries a CVSS v3.1 score of 8.7 and involves cookie forgery that could escalate privileges after authentication.

PLANET’s guidance focuses on applying firmware updates to 3.2412b261022 (or later) and restricting web panel access to trusted local subnets, followed by log review for unusual activity. The article notes there is currently no confirmed exploitation in the wild.