CVE-2024-8448

HIGH EPSS 37.3%

Published Sep 30, 20241y ago · Modified Jun 17, 20261w ago

8.8 CVSS 3.1

High

Published Sep 30, 2024 1y ago

Last Modified Jun 17, 2026 1w ago

Description

Certain switch models from PLANET Technology have a hard-coded credential in the specific command-line interface, allowing remote attackers with regular privilege to log in with this credential and obtain a Linux root shell.

CVSS Details

Base Score

8.8

Exploitability

2.8

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

37.3% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-798 Use of Hard-coded Credentials Authentication

Affected Products 4

Vendor	Product	Version	Range
planet	gs-4210-24p2s_firmware	*	<3.305b240802
planet	gs-4210-24p2s	3.0	any
planet	gs-4210-24pl4c_firmware	*	<2.305b240719
planet	gs-4210-24pl4c	2.0	any

References 2

twcert.org.tw https://www.twcert.org.tw/en/cp-139-8046-057c2-2.html

Third Party Advisory
twcert.org.tw https://www.twcert.org.tw/tw/cp-132-8045-a2804-1.html

Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.