Vulnerability · Published Sep 30, 2024 · Assigned by twcert
CVE-2024-8456PLANET Technology switch devices - Missing Authentication for multiple HTTP routes
Critical 9.8
In plain English
A critical-severity missing authentication in GS-4210-24P2S hardware 3.0 from PLANET Technology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 52.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PLANET Technology | GS-4210-24PL4C hardware 2.0 | 0 – before 2.305b240719 |
| PLANET Technology | GS-4210-24P2S hardware 3.0 | 0 – before 3.305b240802 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-8061-91872-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-8062-92f17-2.html third-party-advisory