CVE-2024-8456: fallo crítico en PLANET Technology GS-4210-24P2S hardware 3.0
PLANET Technology switch devices - Missing Authentication for multiple HTTP routes
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 0.6%
Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
PLANET Technology · GS-4210-24P2S hardware 3.0PLANET Technology · GS-4210-24PL4C hardware 2.0CVEs relacionadas — PLANET Technology GS-4210-24P2S hardware 3.0
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-8454MEDIUMPLANET Technology switch devices - Swctrl service DoS attackEPSS 0.6%CVE-2024-8451HIGHPLANET Technology switch devices - SSH server DoS attackEPSS 0.6%CVE-2024-8448HIGHPLANET Technology switch devices - Remote privilege escalation using hard-coded credentialsEPSS 0.5%CVE-2024-8450HIGHPLANET Technology switch devices - Hard-coded SNMPv1 read-write community stringEPSS 0.4%CVE-2024-8455HIGHPLANET Technology switch devices - Swctrl service exchanges weakly encoded passwordsEPSS 0.3%CVE-2024-8459HIGHPLANET Technology switch devices - Cleartext storage of SNMPv3 users' passwordsEPSS 0.3%