PT-2024-1844 · Unknown · Eds-4000/G4000 Series
Published
2024-02-26
·
Updated
2025-02-25
·
CVE-2024-0387
CVSS v2.0
7.7
High
| Vector | AV:A/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
EDS-4000/G4000 Series versions prior to 3.2
Description
The issue is related to a bypass of access control mechanisms in the web service of the EDS-4000/G4000 Series managed switch firmware. This could allow a remote attacker to send requests to the vulnerable device and, from there, to other devices on the network, potentially bypassing access controls or hiding the source of malicious requests. The affected devices include IP forwarding capabilities that cannot be deactivated by users, which an attacker may exploit to forward requests to a target.
Recommendations
For versions prior to 3.2, consider disabling IP forwarding capabilities as a temporary workaround until a patch is available. Restrict access to the web service of the managed switch to minimize the risk of exploitation. Avoid using the device as a relay for requests to other network devices until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Eds-4000/G4000 Series