Attackers Can Gain Full Control of Devices Through Firmware Upload and Download Vulnerability
CVE-2024-8456

9.8CRITICAL

Key Information:

Vendor

Planet Technology

Status
Gs-4210-24pl4c Hardware 2.0
Gs-4210-24p2s Hardware 3.0
Vendor
CVE Published:
30 September 2024

What is CVE-2024-8456?

Certain models of switches by PLANET Technology have been found to have a vulnerability related to inadequate access controls in their firmware management functions. This flaw permits remote attackers to bypass authentication, enabling them to upload and download firmware as well as system configuration files. Successful exploitation of this vulnerability can result in attackers gaining complete control over the affected devices, leading to potential data breach and network compromise. Administrators are strongly advised to review their device settings and implement appropriate security measures to mitigate risks associated with this vulnerability.

Affected Version(s)

GS-4210-24P2S hardware 3.0 0 < 3.305b240802

GS-4210-24PL4C hardware 2.0 0 < 2.305b240719

References

https://www.twcert.org.tw/tw/cp-132-8061-91872-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-8062-92f17-2.html
third-party-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-8456 : Attackers Can Gain Full Control of Devices Through Firmware Upload and Download Vulnerability