CVE-2024-8455 - CVE House
Back to Database
Status published High CVE-2024-8455

PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords

Vulnerability Description

The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8455

Credits & Attribution

No credits recorded in the NVD database.

References

More from PLANET Technology

View All →
CVE-2024-8459
PLANET Technology switch devices - Cleartext storage of SNMPv3 users' passwords
High 7.2
CVE-2024-8458
PLANET Technology switch devices - Cross-site Request Forgery
High 8.8
CVE-2024-8457
PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management
Medium 4.8
CVE-2024-8456
PLANET Technology switch devices - Missing Authentication for multiple HTTP routes
Critical 9.8
CVE-2024-8454
PLANET Technology switch devices - Swctrl service DoS attack
Medium 5.3

Affected Vendor

PLANET Technology

View all reports →

Affected Software

GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0, IGS-5225-4UP1T2S hardware 1.0
Vulnerable Versions:
0

Timeline

Official Publish: September 30th, 2024
Last Modified: September 30th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-261

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.