High · 8.8 CVE-2024-8448 EUVD-2024-49182GHSA-cq83-7rf3-rgmh

PLANET Technology switch devices - Remote privilege escalation using hard-coded credentials

Published Sep 30, 2024 · Updated Sep 30, 2024 · Assigned by twcert

Vendor: PLANET Technology Product: GS-4210-24P2S hardware 3.0 Product: GS-4210-24PL4C hardware 2.0

Description

Certain switch models from PLANET Technology have a hard-coded credential in the specific command-line interface, allowing remote attackers with regular privilege to log in with this credential and obtain a Linux root shell.

Affected products

Vendor	Product	Affected	Fixed
PLANET Technology	GS-4210-24PL4C hardware 2.0	< 2.305b240719	2.305b240719
PLANET Technology	GS-4210-24P2S hardware 3.0	< 3.305b240802	3.305b240802

References

https://www.twcert.org.tw/tw/cp-132-8045-a2804-1.html third-party-advisory
https://www.twcert.org.tw/en/cp-139-8046-057c2-2.html third-party-advisory