Medium · 4.8 CVE-2024-8457 EUVD-2024-49191GHSA-w7p9-rrc4-fpj6

PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management

Published Sep 30, 2024 · Updated Sep 30, 2024 · Assigned by twcert

Vendor: PLANET Technology Product: GS-4210-24P2S hardware 3.0 Product: GS-4210-24PL4C hardware 2.0

Description

Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users with administrator privileges to inject arbitrary JavaScript, leading to Stored XSS attack.

Affected products

Vendor	Product	Affected	Fixed
PLANET Technology	GS-4210-24PL4C hardware 2.0	< 2.305b240719	2.305b240719
PLANET Technology	GS-4210-24P2S hardware 3.0	< 3.305b240802	3.305b240802

References

https://www.twcert.org.tw/tw/cp-132-8063-01634-1.html third-party-advisory
https://www.twcert.org.tw/en/cp-139-8064-70255-2.html third-party-advisory