CVE-2024-8452 - Vulnerability Details

Vendors	Products
Planet	Gs-4210-24p2s Gs-4210-24p2s Firmware Gs-4210-24pl4c Gs-4210-24pl4c Firmware

Link	Providers
https://www.twcert.org.tw/en/cp-139-8054-231ad-2.html
https://www.twcert.org.tw/tw/cp-132-8053-274bd-1.html

Type	Values Removed	Values Added
First Time appeared		Planet Planet gs-4210-24p2s Planet gs-4210-24p2s Firmware Planet gs-4210-24pl4c Planet gs-4210-24pl4c Firmware
CPEs		cpe:2.3:h:planet:gs-4210-24p2s:3.0:::::::* cpe:2.3:h:planet:gs-4210-24pl4c:2.0:::::::* cpe:2.3:o:planet:gs-4210-24p2s_firmware:::::::: cpe:2.3:o:planet:gs-4210-24pl4c_firmware::::::::
Vendors & Products		Planet Planet gs-4210-24p2s Planet gs-4210-24p2s Firmware Planet gs-4210-24pl4c Planet gs-4210-24pl4c Firmware

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially.
Title		PLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials
Weaknesses		CWE-327 CWE-328
References		https://www.twcert.org.tw/en/cp-139-8054-231ad-2.html https://www.twcert.org.tw/tw/cp-132-8053-274bd-1.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8452", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2024-09-05T02:53:04.816Z", "datePublished": "2024-09-30T07:07:26.325Z", "dateUpdated": "2024-09-30T17:32:24.359Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "GS-4210-24PL4C hardware 2.0", "vendor": "PLANET Technology", "versions": [{"lessThan": "2.305b240719", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "GS-4210-24P2S hardware 3.0", "vendor": "PLANET Technology", "versions": [{"lessThan": "3.305b240802", "status": "affected", "version": "0", "versionType": "custom"}]}], "datePublic": "2024-09-30T07:07:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially.</span>"}], "value": "Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially."}], "impacts": [{"capecId": "CAPEC-55", "descriptions": [{"lang": "en", "value": "CAPEC-55 Rainbow Table Password Cracking"}]}, {"capecId": "CAPEC-97", "descriptions": [{"lang": "en", "value": "CAPEC-97 Cryptanalysis"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-327", "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-328", "description": "CWE-328 Use of Weak Hash", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-09-30T07:07:26.325Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-8053-274bd-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-8054-231ad-2.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update firmware of GS-4210-24PL4C hardware 2.0 to version 2.305b240719 or later.<br>Update firmware of GS-4210-24P2S hardware 3.0 to version 3.305b240802 or later.<br>"}], "value": "Update firmware of GS-4210-24PL4C hardware 2.0 to version 2.305b240719 or later.\nUpdate firmware of GS-4210-24P2S hardware 3.0 to version 3.305b240802 or later."}], "source": {"advisory": "TVN-202409008", "discovery": "EXTERNAL"}, "title": "PLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-30T17:32:02.150081Z", "id": "CVE-2024-8452", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-30T17:32:24.359Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-8452 (string)

assignerOrgId : cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e (string)

state : PUBLISHED (string)

assignerShortName : twcert (string)

dateReserved : 2024-09-05T02:53:04.816Z (string)

datePublished : 2024-09-30T07:07:26.325Z (string)

dateUpdated : 2024-09-30T17:32:24.359Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : GS-4210-24PL4C hardware 2.0 (string)

vendor : PLANET Technology (string)

versions : [ »

0 : { »

lessThan : 2.305b240719 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

1 : { »

defaultStatus : unaffected (string)

product : GS-4210-24P2S hardware 3.0 (string)

vendor : PLANET Technology (string)

versions : [ »

0 : { »

lessThan : 3.305b240802 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

]

datePublic : 2024-09-30T07:07:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially. (string)

}

]

value : Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-55 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-55 Rainbow Table Password Cracking (string)

}

]

}

1 : { »

capecId : CAPEC-97 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-97 Cryptanalysis (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-327 (string)

description : CWE-327 Use of a Broken or Risky Cryptographic Algorithm (string)

lang : en (string)

type : CWE (string)

}

]

}

1 : { »

descriptions : [ »

0 : { »

cweId : CWE-328 (string)

description : CWE-328 Use of Weak Hash (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e (string)

shortName : twcert (string)

dateUpdated : 2024-09-30T07:07:26.325Z (string)

}

references : [ »

0 : { »

tags : [ »

0 : third-party-advisory (string)

]

url : https://www.twcert.org.tw/tw/cp-132-8053-274bd-1.html (string)

}

1 : { »

tags : [ »

0 : third-party-advisory (string)

]

url : https://www.twcert.org.tw/en/cp-139-8054-231ad-2.html (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Update firmware of GS-4210-24PL4C hardware 2.0 to version 2.305b240719 or later. Update firmware of GS-4210-24P2S hardware 3.0 to version 3.305b240802 or later. (string)

}

]

value : Update firmware of GS-4210-24PL4C hardware 2.0 to version 2.305b240719 or later. Update firmware of GS-4210-24P2S hardware 3.0 to version 3.305b240802 or later. (string)

}

]

source : { »

advisory : TVN-202409008 (string)

discovery : EXTERNAL (string)

}

title : PLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-09-30T17:32:02.150081Z (string)

id : CVE-2024-8452 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-30T17:32:24.359Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8452", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-30T17:32:02.150081Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-30T17:32:10.376Z"}}], "cna": {"title": "PLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials", "source": {"advisory": "TVN-202409008", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-55", "descriptions": [{"lang": "en", "value": "CAPEC-55 Rainbow Table Password Cracking"}]}, {"capecId": "CAPEC-97", "descriptions": [{"lang": "en", "value": "CAPEC-97 Cryptanalysis"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PLANET Technology", "product": "GS-4210-24PL4C hardware 2.0", "versions": [{"status": "affected", "version": "0", "lessThan": "2.305b240719", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "PLANET Technology", "product": "GS-4210-24P2S hardware 3.0", "versions": [{"status": "affected", "version": "0", "lessThan": "3.305b240802", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update firmware of GS-4210-24PL4C hardware 2.0 to version 2.305b240719 or later.\nUpdate firmware of GS-4210-24P2S hardware 3.0 to version 3.305b240802 or later.", "supportingMedia": [{"type": "text/html", "value": "Update firmware of GS-4210-24PL4C hardware 2.0 to version 2.305b240719 or later.<br>Update firmware of GS-4210-24P2S hardware 3.0 to version 3.305b240802 or later.<br>", "base64": false}]}], "datePublic": "2024-09-30T07:07:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-8053-274bd-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-8054-231ad-2.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-327", "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-328", "description": "CWE-328 Use of Weak Hash"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-09-30T07:07:26.325Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8452", "state": "PUBLISHED", "dateUpdated": "2024-09-30T17:32:24.359Z", "dateReserved": "2024-09-05T02:53:04.816Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2024-09-30T07:07:26.325Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-8452 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-09-30T17:32:02.150081Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-30T17:32:10.376Z (string)

}

]

cna : { »

title : PLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials (string)

source : { »

advisory : TVN-202409008 (string)

discovery : EXTERNAL (string)

}

impacts : [ »

0 : { »

capecId : CAPEC-55 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-55 Rainbow Table Password Cracking (string)

}

]

}

1 : { »

capecId : CAPEC-97 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-97 Cryptanalysis (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : PLANET Technology (string)

product : GS-4210-24PL4C hardware 2.0 (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

lessThan : 2.305b240719 (string)

versionType : custom (string)

}

]

defaultStatus : unaffected (string)

}

1 : { »

vendor : PLANET Technology (string)

product : GS-4210-24P2S hardware 3.0 (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

lessThan : 3.305b240802 (string)

versionType : custom (string)

}

]

defaultStatus : unaffected (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

value : Update firmware of GS-4210-24PL4C hardware 2.0 to version 2.305b240719 or later. Update firmware of GS-4210-24P2S hardware 3.0 to version 3.305b240802 or later. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Update firmware of GS-4210-24PL4C hardware 2.0 to version 2.305b240719 or later. Update firmware of GS-4210-24P2S hardware 3.0 to version 3.305b240802 or later. (string)

base64 : false (boolean)

}

]

}

]

datePublic : 2024-09-30T07:07:00.000Z (string)

references : [ »

0 : { »

url : https://www.twcert.org.tw/tw/cp-132-8053-274bd-1.html (string)

tags : [ »

0 : third-party-advisory (string)

]

}

1 : { »

url : https://www.twcert.org.tw/en/cp-139-8054-231ad-2.html (string)

tags : [ »

0 : third-party-advisory (string)

]

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-327 (string)

description : CWE-327 Use of a Broken or Risky Cryptographic Algorithm (string)

}

]

}

1 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-328 (string)

description : CWE-328 Use of Weak Hash (string)

}

]

}

]

providerMetadata : { »

orgId : cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e (string)

shortName : twcert (string)

dateUpdated : 2024-09-30T07:07:26.325Z (string)

}

cveMetadata : { »

cveId : CVE-2024-8452 (string)

state : PUBLISHED (string)

dateUpdated : 2024-09-30T17:32:24.359Z (string)

dateReserved : 2024-09-05T02:53:04.816Z (string)

assignerOrgId : cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e (string)

datePublished : 2024-09-30T07:07:26.325Z (string)

assignerShortName : twcert (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:planet:gs-4210-24p2s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "89C0B4AA-848F-4AAC-8C51-8C10AEF0630A", "versionEndExcluding": "3.305b240802", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:planet:gs-4210-24p2s:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "2A30964B-E6B8-4B8A-BE2E-882C0F3D8298", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:planet:gs-4210-24pl4c_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E17E272-4418-4CE7-8E59-44953D19D659", "versionEndExcluding": "2.305b240719", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:planet:gs-4210-24pl4c:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "F8029517-8FAB-4130-81F3-98BB09F4814E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially."}, {"lang": "es", "value": "Ciertos modelos de conmutadores de PLANET Technology solo admiten algoritmos obsoletos para el protocolo de autenticaci\u00f3n y el protocolo de cifrado en el servicio SNMPv3, lo que permite a los atacantes obtener potencialmente credenciales SNMPv3 en texto plano."}], "id": "CVE-2024-8452", "lastModified": "2024-10-04T15:10:17.087", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "twcert@cert.org.tw", "type": "Secondary"}]}, "published": "2024-09-30T07:15:04.647", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/en/cp-139-8054-231ad-2.html"}, {"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-8053-274bd-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-328"}], "source": "twcert@cert.org.tw", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:planet:gs-4210-24p2s_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 89C0B4AA-848F-4AAC-8C51-8C10AEF0630A (string)

versionEndExcluding : 3.305b240802 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:planet:gs-4210-24p2s:3.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 2A30964B-E6B8-4B8A-BE2E-882C0F3D8298 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:planet:gs-4210-24pl4c_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 0E17E272-4418-4CE7-8E59-44953D19D659 (string)

versionEndExcluding : 2.305b240719 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:planet:gs-4210-24pl4c:2.0:*:*:*:*:*:*:* (string)

matchCriteriaId : F8029517-8FAB-4130-81F3-98BB09F4814E (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially. (string)

}

1 : { »

lang : es (string)

value : Ciertos modelos de conmutadores de PLANET Technology solo admiten algoritmos obsoletos para el protocolo de autenticación y el protocolo de cifrado en el servicio SNMPv3, lo que permite a los atacantes obtener potencialmente credenciales SNMPv3 en texto plano. (string)

}

]

id : CVE-2024-8452 (string)

lastModified : 2024-10-04T15:10:17.087 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : twcert@cert.org.tw (string)

type : Secondary (string)

}

]

}

published : 2024-09-30T07:15:04.647 (string)

references : [ »

0 : { »

source : twcert@cert.org.tw (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://www.twcert.org.tw/en/cp-139-8054-231ad-2.html (string)

}

1 : { »

source : twcert@cert.org.tw (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://www.twcert.org.tw/tw/cp-132-8053-274bd-1.html (string)

}

]

sourceIdentifier : twcert@cert.org.tw (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-327 (string)

}

1 : { »

lang : en (string)

value : CWE-328 (string)

}

]

source : twcert@cert.org.tw (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object