Vulnerability · Published Sep 30, 2024 · Assigned by twcert
CVE-2024-8452PLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials
High 7.5
In plain English
A high-severity broken cryptography in GS-4210-24P2S hardware 3.0 from PLANET Technology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.2%top 92.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PLANET Technology | GS-4210-24PL4C hardware 2.0 | 0 – before 2.305b240719 |
| PLANET Technology | GS-4210-24P2S hardware 3.0 | 0 – before 3.305b240802 |
Weakness: CWE-327, CWE-328 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.twcert.org.tw/tw/cp-132-8053-274bd-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-8054-231ad-2.html third-party-advisory