9.8

CVE-2024-8456

PLANET Technology switch devices - Missing Authentication for multiple HTTP routes

Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Planet ≫ Gs-4210-24p2s Firmware Version < 3.305b240802
   Planet ≫ Gs-4210-24p2s Version3.0
Planet ≫ Gs-4210-24pl4c Firmware Version < 2.305b240719
   Planet ≫ Gs-4210-24pl4c Version2.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.58% 0.43
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
twcert@cert.org.tw 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://www.twcert.org.tw/en/cp-139-8062-92f17-2.html
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-8061-91872-1.html
Third Party Advisory