CVE-2024-8455
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.2 / Impact: 3.6
Source: NVD
Description
The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords.
Affected (3)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 3.305b240802 |
| Running on/with | Platform Versions |
|---|---|
Planet Gs 4210 24p2s | Version 3.0 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Before 2.305b240719 |
| Running on/with | Platform Versions |
|---|---|
Planet Gs 4210 24pl4c | Version 2.0 |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| All versions |
| Running on/with | Platform Versions |
|---|---|
Planet Igs 5225 4up1t2s | Version 1.0 |
Related CWEs
CWE-261
Weak Encoding for Password
Obscuring a password with a trivial encoding does not protect the password.
CWE-326
Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
References (2)
Timeline
No history available yet.