CVE Feed

    Dashboard / CVE / CVE-2024-8455

    CVE-2024-8455

    The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords.

    Published:Sep 30, 2024
    Last Modified:Oct 4, 2024
    EPS:Sep 30, 2024
    EPSS Score:0.00104
    CVSS Score:8.1

    Affected Products

    Vendor
    Planet
    Product
    Gs-4210-24p2s
    Vendor
    Planet
    Product
    Gs-4210-24p2s Firmware
    Vendor
    Planet
    Product
    Gs-4210-24pl4c
    Vendor
    Planet
    Product
    Gs-4210-24pl4c Firmware
    Vendor
    Planet
    Product
    Igs-5225-4up1t2s
    Vendor
    Planet
    Product
    Igs-5225-4up1t2s Firmware
    Vendor
    Planet Technology Corp
    Product
    Gs-4210-24pl4c Hardware 2.0
    Vendor
    Planet Technology Corp
    Product
    Gs-4210-24pl4c Hardware 3.0
    Vendor
    Planet Technology Corp
    Product
    Igs-5225-4up1t2s Hardware 1.0

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-8459 (CVSS 7.2) — Certain switch models from PLANET Technology store SNMPv3 users' passwords in plaintext within the configurati…
    CVE-2024-8458 (CVSS 8.8) — Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request F…
    CVE-2024-8457 (CVSS 4.8) — Certain switch models from PLANET Technology have a web application that does not properly validate specific p…
    CVE-2024-8456 (CVSS 9.8) — Certain switch models from PLANET Technology lack proper access control in firmware upload and download functi…
    CVE-2024-8454 (CVSS 5.3) — The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have…
    CVE-2024-8453 (CVSS 4.9) — Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without b…
    CVE-2024-8452 (CVSS 7.5) — Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and …
    CVE-2024-8451 (CVSS 7.5) — Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authen…
    CVE-2024-8450 (CVSS 8.6) — Certain switch models from PLANET Technology have a Hard-coded community string in the SNMPv1 service, allowin…
    CVE-2024-8449 (CVSS 6.8) — Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functiona…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High