Vulnerability · Published Sep 30, 2024 · Assigned by twcert
CVE-2024-8451PLANET Technology switch devices - SSH server DoS attack
High 7.5
In plain English
A high-severity uncontrolled resource consumption in GS-4210-24P2S hardware 3.0 from PLANET Technology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 53.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorized remote attackers to exploit this weakness to occupy connection slots and prevent legitimate users from accessing the SSH service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PLANET Technology | GS-4210-24PL4C hardware 2.0 | 0 – before 2.305b240719 |
| PLANET Technology | GS-4210-24P2S hardware 3.0 | 0 – before 3.305b240802 |
Weakness: CWE-400, CWE-280 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://www.twcert.org.tw/tw/cp-132-8051-5048e-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-8052-ac0ea-2.html third-party-advisory