CVE-2024-8455PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords
- 8.1HighCVSS base score
- 0.34%Exploitation in 30 daysEPSS · top 72% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords.
Timeline
ID reserved
By twcert
- 25 days later
· 25 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| twcertCNA (assigner) | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | Medium5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.34% · top 72% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Affected products
PLANET Technology · GS-4210-24PL4C hardware 2.0
- affected < 2.305b240719
PLANET Technology · GS-4210-24P2S hardware 3.0
- affected < 3.305b240802
PLANET Technology · IGS-5225-4UP1T2S hardware 1.0
- affected 0
What to do
Solution: Update firmware of GS-4210-24PL4C hardware 2.0 to version 2.305b240719 or later. Update firmware of GS-4210-24P2S hardware 3.0 to version 3.305b240802 or later. IGS-5225-4UP1T2S hardware 1.0 has reached End of Life (EOL). Replacement is recommended.
References
References2
- https://www.twcert.org.tw/tw/cp-132-8059-bde5f-1.html (opens in a new tab)third-party-advisory
- https://www.twcert.org.tw/en/cp-139-8060-f3955-2.html (opens in a new tab)third-party-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-49189 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-8455)Record last updated .