Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26

Export CSV
CVE-2024-8449

PLANET Technology switch devices - Local users' passwords recovery through hard-coded credentials

Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Planet Planet Technology Corp
Products
Gs-4210-24p2s Gs-4210-24p2s Firmware Gs-4210-24pl4c and 3 more
CVE-2024-8448

PLANET Technology switch devices - Remote privilege escalation using hard-coded credentials

Certain switch models from PLANET Technology have a hard-coded credential in the specific command-line interface, allowing remote attackers with regular privilege to log in with this credential and obtain a Linux root shell.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Planet Planet Technology Corp
Products
Gs-4210-24p2s Gs-4210-24p2s Firmware Gs-4210-24pl4c and 3 more
CVE-2024-8455

PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords

The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Planet Planet Technology Corp
Products
Gs-4210-24p2s Gs-4210-24p2s Firmware Gs-4210-24pl4c and 6 more
CVE-2024-8456

PLANET Technology switch devices - Missing Authentication for multiple HTTP routes

Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Planet Planet Technology Corp
Products
Gs-4210-24p2s Gs-4210-24p2s Firmware Gs-4210-24pl4c and 3 more
CVE-2024-8458

PLANET Technology switch devices - Cross-site Request Forgery

Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker can trick a user into visiting a malicious website, allowing the attacker to impersonate the user and perform actions on their behalf, such as creating accounts.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Planet Planet Technology Corp
Products
Gs-4210-24p2s Gs-4210-24p2s Firmware Gs-4210-24pl4c and 3 more
CVE-2024-8459

PLANET Technology switch devices - Cleartext storage of SNMPv3 users' passwords

Certain switch models from PLANET Technology store SNMPv3 users' passwords in plaintext within the configuration files, allowing remote attackers with administrator privileges to read the file and obtain the credentials.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Planet Planet Technology Corp
Products
Gs-4210-24p2s Gs-4210-24p2s Firmware Gs-4210-24pl4c and 3 more