Paper/Archive/CVE-2024-8456

CVE-2024-8456

PLANET Technology GS-4210-24PL4C hardware 2.0 — PLANET Technology switch devices - Missing Authentication for multiple HTTP routes

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 47.7.477 × 209.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices.

Affected

ProductAffectedFixed inSource

GS-4210-24PL4C hardware 2.0< 2.305b2407192.305b240719CNA

GS-4210-24P2S hardware 3.0< 3.305b2408023.305b240802CNA

gs-4210-24pl4c_hardware_2.0< 2.305b2407192.305b240719CISA-ADP

gs-4210-24pl4c_hardware_3.0< 3.305b2408023.305b240802CISA-ADP

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-8061-91872-1.html writeuptwcert.org.tw/en/cp-139-8062-92f17-2.html