CVE-2024-8457

Published: Sep 30, 2024Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: twcert@cert.org.tw (Secondary)

Description

Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users with administrator privileges to inject arbitrary JavaScript, leading to Stored XSS attack.

Affected (2)

Products: Planet: Gs 4210 24p2s Firmware, Gs 4210 24pl4c Firmware

Planet

2 products

Gs 4210 24p2s Firmware

Gs 4210 24pl4c Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Planet Gs 4210 24p2s Firmware	Before 3.305b240802

Running on/with	Platform Versions
Planet Gs 4210 24p2s	Version 3.0

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Planet Gs 4210 24pl4c Firmware	Before 2.305b240719

Running on/with	Platform Versions
Planet Gs 4210 24pl4c	Version 2.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.twcert.org.tw/en/cp-139-8064-70255-2.html

Source: twcert@cert.org.tw

Third Party Advisory

https://www.twcert.org.tw/tw/cp-132-8063-01634-1.html

Source: twcert@cert.org.tw

Third Party Advisory

Timeline

No history available yet.