← Back

CVE-2024-8456

nvd nist
Published: Sep 30, 2024Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: twcert@cert.org.tw (Secondary)

Description

Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices.

Affected (2)

Planet
2 products
Gs 4210 24p2s Firmware
Gs 4210 24pl4c Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Gs 4210 24p2s Firmware
Before 3.305b240802
Running on/withPlatform Versions
Planet
Gs 4210 24p2s
Version 3.0
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Gs 4210 24pl4c Firmware
Before 2.305b240719
Running on/withPlatform Versions
Planet
Gs 4210 24pl4c
Version 2.0

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

Source: twcert@cert.org.tw
Third Party Advisory
Source: twcert@cert.org.tw
Third Party Advisory

Timeline

No history available yet.