CVE-2024-8449 — PLANET Technology switch devices - Local users' passwords recovery through hard-coded credentials

CVE-2024-8449

PLANET Technology switch devices - Local users' passwords recovery through hard-coded credentials PUBLISHED

Description (CNA)

Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password.

Affected (CNA)

Vendor / product	Versions
PLANET Technology / GS-4210-24PL4C hardware 2.0	affected 0 before 2.305b240719
PLANET Technology / GS-4210-24P2S hardware 3.0	affected 0 before 3.305b240802

CWE

CWE-798

References

https://www.twcert.org.tw/tw/cp-132-8047-adf79-1.html
https://www.twcert.org.tw/en/cp-139-8048-f0e4d-2.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.