Back to Database
Status published
Critical
CVE-2024-8456
PLANET Technology switch devices - Missing Authentication for multiple HTTP routes
Vulnerability Description
Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8456
Credits & Attribution
No credits recorded in the NVD database.
References
More from PLANET Technology
View All →CVE-2024-8459
PLANET Technology switch devices - Cleartext storage of SNMPv3 users' passwords
High
7.2
CVE-2024-8458
PLANET Technology switch devices - Cross-site Request Forgery
High
8.8
CVE-2024-8457
PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management
Medium
4.8
CVE-2024-8455
PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords
High
8.1
CVE-2024-8454
PLANET Technology switch devices - Swctrl service DoS attack
Medium
5.3
Affected Vendor
PLANET Technology
View all reports →Affected Software
GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0
Vulnerable Versions:
0
Timeline
Official Publish:
September 30th, 2024
Last Modified:
September 30th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H