Cyber Resilience

CVE-2024-8455

High

Published: 30 September 2024

Published
30 September 2024
Modified
04 October 2024
KEV Added
Patch
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0021 43.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-8455 is a high-severity Weak Encoding for Password (CWE-261) vulnerability in Planet Gs-4210-24P2S Firmware. Its CVSS base score is 8.1 (High).

Operationally, ranked at the 43.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the…

more

packets can directly crack them to obtain plaintext passwords.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

planet
gs-4210-24p2s firmware
≤ 3.305b240802
planet
gs-4210-24pl4c firmware
≤ 2.305b240719
planet
igs-5225-4up1t2s firmware
all versions

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-326

Maintaining currency with technologies and practices reduces selection of encryption mechanisms that provide inadequate strength.

addresses: CWE-326

Updated assessments identify when previously adequate encryption strength no longer meets current attack capabilities or compliance drivers.

addresses: CWE-326

Establishment procedures require selection and generation of keys with adequate length and strength for the chosen algorithm.

addresses: CWE-326

Specifies required cryptography types and parameters, preventing selection of inadequate encryption strength.

addresses: CWE-326

Prompt patching corrects inadequate encryption strength when vendors release updates that increase key sizes or algorithm security.

References