CVE Feed

    Dashboard / CVE / CVE-2024-8449

    CVE-2024-8449

    Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password.

    Published:Sep 30, 2024
    Last Modified:Oct 4, 2024
    EPS:Sep 30, 2024
    EPSS Score:0.00146
    CVSS Score:6.8

    Affected Products

    Vendor
    Planet
    Product
    Gs-4210-24p2s
    Vendor
    Planet
    Product
    Gs-4210-24p2s Firmware
    Vendor
    Planet
    Product
    Gs-4210-24pl4c
    Vendor
    Planet
    Product
    Gs-4210-24pl4c Firmware
    Vendor
    Planet Technology Corp
    Product
    Gs-4210-24pl4c Hardware 2.0
    Vendor
    Planet Technology Corp
    Product
    Gs-4210-24pl4c Hardware 3.0

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-798 Use of Hard-coded Credentials

    Related CVEs

    CVE-2024-8459 (CVSS 7.2) — Certain switch models from PLANET Technology store SNMPv3 users' passwords in plaintext within the configurati…
    CVE-2024-8458 (CVSS 8.8) — Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request F…
    CVE-2024-8457 (CVSS 4.8) — Certain switch models from PLANET Technology have a web application that does not properly validate specific p…
    CVE-2024-8456 (CVSS 9.8) — Certain switch models from PLANET Technology lack proper access control in firmware upload and download functi…
    CVE-2024-8455 (CVSS 8.1) — The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models,…
    CVE-2024-8454 (CVSS 5.3) — The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have…
    CVE-2024-8453 (CVSS 4.9) — Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without b…
    CVE-2024-8452 (CVSS 7.5) — Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and …
    CVE-2024-8451 (CVSS 7.5) — Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authen…
    CVE-2024-8450 (CVSS 8.6) — Certain switch models from PLANET Technology have a Hard-coded community string in the SNMPv1 service, allowin…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High