« Volver al listado

CVE-2024-8449

Estado: AnalizadaMedia (6.8)—

Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Planet — Gs-4210-24p2s FirmwarePlanet — Gs-4210-24pl4c Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-8449",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8449",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-30T17:04:05.199249Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "PLANET Technology",
          "product": "GS-4210-24PL4C hardware 2.0",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.305b240719",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "PLANET Technology",
          "product": "GS-4210-24P2S hardware 3.0",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.305b240802",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:planet_technology_corp:gs-4210-24pl4c_hardware_2.0:*:*:*:*:*:*:*:*"
          ],
          "vendor": "planet_technology_corp",
          "product": "gs-4210-24pl4c_hardware_2.0",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.305b240719",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:planet_technology_corp:gs-4210-24pl4c_hardware_3.0:*:*:*:*:*:*:*:*"
          ],
          "vendor": "planet_technology_corp",
          "product": "gs-4210-24pl4c_hardware_3.0",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.305b240802",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-30T07:15:03.937",
  "references": [
    {
      "url": "https://www.twcert.org.tw/en/cp-139-8048-f0e4d-2.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-8047-adf79-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password."
    },
    {
      "lang": "es",
      "value": "Ciertos modelos de conmutadores de PLANET Technology tienen una credencial codificada en la funcionalidad de recuperación de contraseña, lo que permite que un atacante no autenticado se conecte al dispositivo a través de la consola serial y use esta credencial para restablecer la contraseña de cualquier usuario."
    }
  ],
  "lastModified": "2026-06-17T08:22:35.740",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:planet:gs-4210-24p2s_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89C0B4AA-848F-4AAC-8C51-8C10AEF0630A",
              "versionEndExcluding": "3.305b240802"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:planet:gs-4210-24p2s:3.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2A30964B-E6B8-4B8A-BE2E-882C0F3D8298"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:planet:gs-4210-24pl4c_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E17E272-4418-4CE7-8E59-44953D19D659",
              "versionEndExcluding": "2.305b240719"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:planet:gs-4210-24pl4c:2.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F8029517-8FAB-4130-81F3-98BB09F4814E"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}