CVE-2024-8455CWE-261

PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords

High · published September 30, 2024

CVSS v3.1
8.1
EPSS
0%
Percentile
26.3
In the wild
Unconfirmed
What it is

The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00341 · 26.3th percentile
Weakness
CWE-261 · Weak Encoding for Password
Published
2024-09-30T07:24Z
EPSS history
Timeline
  • 30 SEP 07:24Z
    PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords
    cvelistv5