CVE-2024-8456CWE-306

PLANET Technology switch devices - Missing Authentication for multiple HTTP routes

Critical · published September 30, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

🚨 A simple lack of access control could let attackers upload and download firmware on certain PLANET Technology switches! 🔥 Think of it as leaving the back door to your data center wide open—anyone could stroll in and change the locks or take the server with them! This vulnerability is absolutely devastating! Unauthenticated attackers could gain full control of your network devices, potentially leading to data breaches, unauthorized access, or service disruptions. Imagine a malicious entity hijacking your infrastructure—it's a nightmare scenario!

Put simply

Think of it as leaving the back door to your data center wide open—anyone could stroll in and change the locks or take the server with them! This vulnerability allows attackers to exploit improper access controls in the firmware upload and download functions, enabling them to manipulate the device settings and firmware without authentication.

What to do

This vulnerability is absolutely devastating! Unauthenticated attackers could gain full control of your network devices, potentially leading to data breaches, unauthorized access, or service disruptions. Imagine a malicious entity hijacking your infrastructure—it's a nightmare scenario! Immediately review the affected switch models from PLANET Technology and apply any available patches. Implement network segmentation and access controls to limit exposure while you work on a permanent fix. Don't wait—secure your devices now! You've got this! Follow these steps, and you'll protect your devices in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00579 · 47.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2024-09-30T07:35Z
EPSS history
Timeline
  • 30 SEP 07:35Z
    PLANET Technology switch devices - Missing Authentication for multiple HTTP routes
    cvelistv5