CVE-2024-8456: PLANET Technology switch devices - Missing Authentication for multiple HTTP routes
Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8456?
CVE-2024-8456 has a high severity rating due to the potential for unauthenticated remote attackers to gain full control over the affected devices.
How do I fix CVE-2024-8456?
To fix CVE-2024-8456, it is essential to update the firmware of affected PLANET Technology switch models to the latest version that addresses this vulnerability.
Which devices are affected by CVE-2024-8456?
CVE-2024-8456 affects certain models from PLANET Technology, including the GS-4210-24p2s and GS-4210-24pl4c with specified firmware versions.
What are the consequences of exploiting CVE-2024-8456?
Exploiting CVE-2024-8456 could allow attackers to upload and download firmware and system configurations, leading to full control over the devices.
Is CVE-2024-8456 related to any specific firmware version?
Yes, CVE-2024-8456 is specifically related to firmware versions prior to 3.305b240802 for GS-4210-24p2s and 2.305b240719 for GS-4210-24pl4c.