Back to Database
Status published
Medium
CVE-2024-8449
PLANET Technology switch devices - Local users' passwords recovery through hard-coded credentials
Vulnerability Description
Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8449
Credits & Attribution
No credits recorded in the NVD database.
References
More from PLANET Technology
View All →CVE-2024-8459
PLANET Technology switch devices - Cleartext storage of SNMPv3 users' passwords
High
7.2
CVE-2024-8458
PLANET Technology switch devices - Cross-site Request Forgery
High
8.8
CVE-2024-8457
PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management
Medium
4.8
CVE-2024-8456
PLANET Technology switch devices - Missing Authentication for multiple HTTP routes
Critical
9.8
CVE-2024-8455
PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords
High
8.1
Affected Vendor
PLANET Technology
View all reports →Affected Software
GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0
Vulnerable Versions:
0
Timeline
Official Publish:
September 30th, 2024
Last Modified:
September 30th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H