PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords

published 2024-09-30 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-49189

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits: 0; none known

The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords.

Patch / fix

fixed in 4

PLANET Technology GS-4210-24PL4C hardware 2.0 2.305b240719
PLANET Technology GS-4210-24P2S hardware 3.0 3.305b240802
planet_technology_corp gs-4210-24pl4c_hardware_2.0 2.305b240719
planet_technology_corp gs-4210-24pl4c_hardware_3.0 3.305b240802

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-09-30)

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

PLANET Technology GS-4210-24PL4C hardware 2.0
PLANET Technology GS-4210-24P2S hardware 3.0
PLANET Technology IGS-5225-4UP1T2S hardware 1.0
planet_technology_corp gs-4210-24pl4c_hardware_2.0
planet_technology_corp gs-4210-24pl4c_hardware_3.0
planet_technology_corp igs-5225-4up1t2s_hardware_1.0

Classification

Weakness

CWE-261 Weak Encoding for Password
CWE-326 Inadequate Encryption Strength

References

twcert.org.tw /tw/cp-132-8059-bde5f-1.html
third-party-advisory
twcert.org.tw /en/cp-139-8060-f3955-2.html
third-party-advisory

Sources

CVE List CVE-2024-8455
NVD CVE-2024-8455

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary