CVEvulnerability

CVE-2024-8455

5.9 MEDIUM Published 2024-09-30 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-09-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-261, CWE-326

Description

The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords.

Affected configurations

• planet gs-4210-24p2s firmware (< 3.305b240802) • planet gs-4210-24pl4c firmware (< 2.305b240719) • planet igs-5225-4up1t2s firmware

Related

Weakness · CWE (2)

  • CWE-261 Weak Encoding for Password weakness
  • CWE-326 Inadequate Encryption Strength weakness

References