CVE-2024-8453CWE-328CWE-759

PLANET Technology switch devices - Weak hash for users' passwords

Medium · published September 30, 2024

CVSS v3.1
4.9
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without being salted. Remote attackers with administrator privileges can read configuration files to obtain the hash values, and potentially crack them to retrieve the plaintext passwords.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.1th percentile
Weaknesses
CWE-328 · Use of Weak Hash; CWE-759 · Use of a One-Way Hash without a Salt
Published
2024-09-30T07:12Z
EPSS history
Timeline
  • 30 SEP 07:12Z
    PLANET Technology switch devices - Weak hash for users' passwords
    cvelistv5