PT-2024-39028 · Planet Technology · Planet Technology Switch

Published 2024-09-30 · Updated 2024-10-04 · CVE-2024-8459

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: PLANET Technology switch models (affected versions not specified)

Description: The issue concerns certain switch models from PLANET Technology that store SNMPv3 users' passwords in plaintext within the configuration files. This allows remote attackers with administrator privileges to read the file and obtain the credentials.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2024-8459

Affected Products

Planet Technology Switch

References · 11

• https://osv.dev/vulnerability/CVE-2024-8459 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8459 · Security Note
• https://t.me/latest_high_impact_cve/1235 · Telegram Post
• https://twcert.org.tw/en/cp-139-8068-8aaa5-2.html · Note
• https://twitter.com/cracbot/status/1842082290803130764 · Twitter Post
• https://t.me/cvedetector/6637 · Telegram Post
• https://t.me/cvenotify/97046 · Telegram Post
• https://twitter.com/CVEnew/status/1840668535573315862 · Twitter Post
• https://twitter.com/AegisLens/status/1841101266803438021 · Twitter Post
• https://twcert.org.tw/tw/cp-132-8067-2fc50-1.html · Note
• https://twitter.com/VulmonFeeds/status/1840714734829473980 · Twitter Post