PT-2024-39025 · Planet Technology · Planet Technology Devices

Published 2024-09-30 · Updated 2024-10-04 · CVE-2024-8455

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: PLANET Technology devices (affected versions not specified)

Description: The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-261

Related Identifiers

CVE-2024-8455

Affected Products

Planet Technology Devices

References · 11

• https://osv.dev/vulnerability/CVE-2024-8455 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8455 · Security Note
• https://twcert.org.tw/tw/cp-132-8059-bde5f-1.html · Note
• https://t.me/cvenotify/97042 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1840709611575259307 · Twitter Post
• https://twitter.com/AegisLens/status/1841211743881609568 · Twitter Post
• https://t.me/cvedetector/6642 · Telegram Post
• https://twitter.com/cracbot/status/1842082285891551700 · Twitter Post
• https://twitter.com/CVEnew/status/1840658009204371847 · Twitter Post
• https://twcert.org.tw/en/cp-139-8060-f3955-2.html · Note
• https://t.me/latest_high_impact_cve/1234 · Telegram Post