Insecure Hashing Function Exposed in PLANET Technology Switches, Plaintext Passwords at Risk
CVE-2024-8453

4.9MEDIUM

Key Information:

Vendor

Planet Technology

Status
Gs-4210-24pl4c Hardware 2.0
Gs-4210-24p2s Hardware 3.0
Vendor
CVE Published:
30 September 2024

What is CVE-2024-8453?

Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without being salted. Remote attackers with administrator privileges can read configuration files to obtain the hash values, and potentially crack them to retrieve the plaintext passwords.

Affected Version(s)

GS-4210-24P2S hardware 3.0 0 < 3.305b240802

GS-4210-24PL4C hardware 2.0 0 < 2.305b240719

References

https://www.twcert.org.tw/tw/cp-132-8055-2c361-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-8056-09688-2.html
third-party-advisory

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.