CVE Feed

    Dashboard / CVE / CVE-2024-8459

    CVE-2024-8459

    Certain switch models from PLANET Technology store SNMPv3 users' passwords in plaintext within the configuration files, allowing remote attackers with administrator privileges to read the file and obtain the credentials.

    Published:Sep 30, 2024
    Last Modified:Oct 4, 2024
    EPS:Sep 30, 2024
    EPSS Score:0.00086
    CVSS Score:7.2

    Affected Products

    Vendor
    Planet
    Product
    Gs-4210-24p2s
    Vendor
    Planet
    Product
    Gs-4210-24p2s Firmware
    Vendor
    Planet
    Product
    Gs-4210-24pl4c
    Vendor
    Planet
    Product
    Gs-4210-24pl4c Firmware
    Vendor
    Planet Technology Corp
    Product
    Gs-4210-24pl4c Hardware 2.0
    Vendor
    Planet Technology Corp
    Product
    Gs-4210-24pl4c Hardware 3.0

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-37 Retrieve Embedded Sensitive Data

    Related CVEs

    CVE-2024-8458 (CVSS 8.8) — Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request F…
    CVE-2024-8457 (CVSS 4.8) — Certain switch models from PLANET Technology have a web application that does not properly validate specific p…
    CVE-2024-8456 (CVSS 9.8) — Certain switch models from PLANET Technology lack proper access control in firmware upload and download functi…
    CVE-2024-8455 (CVSS 8.1) — The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models,…
    CVE-2024-8454 (CVSS 5.3) — The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have…
    CVE-2024-8453 (CVSS 4.9) — Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without b…
    CVE-2024-8452 (CVSS 7.5) — Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and …
    CVE-2024-8451 (CVSS 7.5) — Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authen…
    CVE-2024-8450 (CVSS 8.6) — Certain switch models from PLANET Technology have a Hard-coded community string in the SNMPv1 service, allowin…
    CVE-2024-8449 (CVSS 6.8) — Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functiona…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High