CVE-2024-8449: PLANET Technology switch devices - Local users' passwords recovery through hard-coded credentials
Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8449?
CVE-2024-8449 is classified as a high-severity vulnerability due to the ease of exploitation and potential unauthorized access to device functionalities.
How do I fix CVE-2024-8449?
To mitigate CVE-2024-8449, update the firmware of the affected PLANET Technology switch models to the latest version that addresses the hard-coded credential issue.
Which devices are affected by CVE-2024-8449?
CVE-2024-8449 affects certain models of PLANET Technology switches including the GS-4210-24P2S and GS-4210-24PL4C with specific firmware versions.
Can CVE-2024-8449 be exploited remotely?
No, CVE-2024-8449 requires physical access to the device through the serial console, making the attack vector local rather than remote.
What are the implications of CVE-2024-8449 for organizations?
Organizations using affected devices may face significant security risks if an attacker exploits the hard-coded credential to reset user passwords and gain unauthorized access.