Vulnerability · Published Mar 8, 2026 · Assigned by VulDB

CVE-2026-3697Planet ICG-2510 Language Package Configuration httpd sub_40C8E4 stack-based overflow

Medium 6.3

In plain English

A medium-severity stack buffer overflow in ICG-2510 from Planet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Planet ICG-2510 1.0_20250811. The impacted element is the function sub_40C8E4 of the file /usr/sbin/httpd of the component Language Package Configuration Handler. Executing a manipulation of the argument Language can lead to stack-based buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Planet	ICG-2510	1.0_20250811

Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-349643 | Planet ICG-2510 Language Package Configuration httpd sub_40C8E4 stack-based overflow vdb-entry, technical-description
VDB-349643 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #765682 | PLANET ICG-2510 1.0_20250811 Stack-based Buffer Overflow third-party-advisory
https://github.com/glkfc/IoT-Vulnerability/blob/main/PLANET/ICG-2510/vulnerability_report1.md related