CVE-2026-81942

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system() without sufficient filtering, allowing a remote authenticated attacker to execute arbitrary commands on the underlying operating system and escalate privileges to root.

  • Published Sep 18, 2026
  • CVSS 8.7 high
  • 1.9% chance of exploitation in the next 30 days (EPSS)
  • A fix is available

Affected software

CVE-2026-81942 at the National Vulnerability Database