CVE Feed

    Dashboard / CVE / CVE-2024-8458

    CVE-2024-8458

    Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker can trick a user into visiting a malicious website, allowing the attacker to impersonate the user and perform actions on their behalf, such as creating accounts.

    Published:Sep 30, 2024
    Last Modified:Oct 4, 2024
    EPS:Sep 30, 2024
    EPSS Score:0.00113
    CVSS Score:8.8

    Affected Products

    Vendor
    Planet
    Product
    Gs-4210-24p2s
    Vendor
    Planet
    Product
    Gs-4210-24p2s Firmware
    Vendor
    Planet
    Product
    Gs-4210-24pl4c
    Vendor
    Planet
    Product
    Gs-4210-24pl4c Firmware
    Vendor
    Planet Technology Corp
    Product
    Gs-4210-24pl4c Hardware 2.0
    Vendor
    Planet Technology Corp
    Product
    Gs-4210-24pl4c Hardware 3.0

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-8459 (CVSS 7.2) — Certain switch models from PLANET Technology store SNMPv3 users' passwords in plaintext within the configurati…
    CVE-2024-8457 (CVSS 4.8) — Certain switch models from PLANET Technology have a web application that does not properly validate specific p…
    CVE-2024-8456 (CVSS 9.8) — Certain switch models from PLANET Technology lack proper access control in firmware upload and download functi…
    CVE-2024-8455 (CVSS 8.1) — The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models,…
    CVE-2024-8454 (CVSS 5.3) — The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have…
    CVE-2024-8453 (CVSS 4.9) — Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without b…
    CVE-2024-8452 (CVSS 7.5) — Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and …
    CVE-2024-8451 (CVSS 7.5) — Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authen…
    CVE-2024-8450 (CVSS 8.6) — Certain switch models from PLANET Technology have a Hard-coded community string in the SNMPv1 service, allowin…
    CVE-2024-8449 (CVSS 6.8) — Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functiona…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High