{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8454", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2024-09-05T02:53:07.051Z", "datePublished": "2024-09-30T07:18:30.271Z", "dateUpdated": "2024-09-30T16:59:40.972Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "GS-4210-24PL4C hardware 2.0", "vendor": "PLANET Technology", "versions": [{"lessThan": "2.305b240719", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "GS-4210-24P2S hardware 3.0", "vendor": "PLANET Technology", "versions": [{"lessThan": "3.305b240802", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "IGS-5225-4UP1T2S hardware 1.0", "vendor": "PLANET Technology", "versions": [{"status": "affected", "version": "0"}]}], "datePublic": "2024-09-30T07:13:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerability in the swctrl service, allowing unauthenticated remote attackers to send crafted packets that can crash the service.</span>"}], "value": "The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerability in the swctrl service, allowing unauthenticated remote attackers to send crafted packets that can crash the service."}], "impacts": [{"capecId": "CAPEC-227", "descriptions": [{"lang": "en", "value": "CAPEC-227 Sustained Client Engagement"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-09-30T07:18:30.271Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-8057-1b3fa-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-8058-cc391-2.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update firmware of GS-4210-24PL4C hardware 2.0 to version 2.305b240719 or later.<br>Update firmware of GS-4210-24P2S hardware 3.0 to version 3.305b240802 or later.<br>IGS-5225-4UP1T2S hardware 1.0 has reached End of Life (EOL). Replacement is recommended.<br>"}], "value": "Update firmware of GS-4210-24PL4C hardware 2.0 to version 2.305b240719 or later.\nUpdate firmware of GS-4210-24P2S hardware 3.0 to version 3.305b240802 or later.\nIGS-5225-4UP1T2S hardware 1.0 has reached End of Life (EOL). Replacement is recommended."}], "source": {"advisory": "TVN-202409010", "discovery": "EXTERNAL"}, "title": "PLANET Technology switch devices - Swctrl service DoS attack", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "planet_technology_corp", "product": "gs-4210-24pl4c_hardware_2.0", "cpes": ["cpe:2.3:a:planet_technology_corp:gs-4210-24pl4c_hardware_2.0:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.305b240719", "versionType": "custom"}]}, {"vendor": "planet_technology_corp", "product": "gs-4210-24pl4c_hardware_3.0", "cpes": ["cpe:2.3:a:planet_technology_corp:gs-4210-24pl4c_hardware_3.0:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.305b240802", "versionType": "custom"}]}, {"vendor": "planet_technology_corp", "product": "igs-5225-4up1t2s_hardware_1.0", "cpes": ["cpe:2.3:a:planet_technology_corp:igs-5225-4up1t2s_hardware_1.0:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-30T16:57:41.398680Z", "id": "CVE-2024-8454", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-30T16:59:40.972Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8454", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-30T16:57:41.398680Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:planet_technology_corp:gs-4210-24pl4c_hardware_2.0:*:*:*:*:*:*:*:*"], "vendor": "planet_technology_corp", "product": "gs-4210-24pl4c_hardware_2.0", "versions": [{"status": "affected", "version": "0", "lessThan": "2.305b240719", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:planet_technology_corp:gs-4210-24pl4c_hardware_3.0:*:*:*:*:*:*:*:*"], "vendor": "planet_technology_corp", "product": "gs-4210-24pl4c_hardware_3.0", "versions": [{"status": "affected", "version": "0", "lessThan": "3.305b240802", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:planet_technology_corp:igs-5225-4up1t2s_hardware_1.0:*:*:*:*:*:*:*:*"], "vendor": "planet_technology_corp", "product": "igs-5225-4up1t2s_hardware_1.0", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-30T16:59:34.155Z"}}], "cna": {"title": "PLANET Technology switch devices - Swctrl service DoS attack", "source": {"advisory": "TVN-202409010", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-227", "descriptions": [{"lang": "en", "value": "CAPEC-227 Sustained Client Engagement"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PLANET Technology", "product": "GS-4210-24PL4C hardware 2.0", "versions": [{"status": "affected", "version": "0", "lessThan": "2.305b240719", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "PLANET Technology", "product": "GS-4210-24P2S hardware 3.0", "versions": [{"status": "affected", "version": "0", "lessThan": "3.305b240802", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "PLANET Technology", "product": "IGS-5225-4UP1T2S hardware 1.0", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update firmware of GS-4210-24PL4C hardware 2.0 to version 2.305b240719 or later.\nUpdate firmware of GS-4210-24P2S hardware 3.0 to version 3.305b240802 or later.\nIGS-5225-4UP1T2S hardware 1.0 has reached End of Life (EOL). Replacement is recommended.", "supportingMedia": [{"type": "text/html", "value": "Update firmware of GS-4210-24PL4C hardware 2.0 to version 2.305b240719 or later.<br>Update firmware of GS-4210-24P2S hardware 3.0 to version 3.305b240802 or later.<br>IGS-5225-4UP1T2S hardware 1.0 has reached End of Life (EOL). Replacement is recommended.<br>", "base64": false}]}], "datePublic": "2024-09-30T07:13:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-8057-1b3fa-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-8058-cc391-2.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerability in the swctrl service, allowing unauthenticated remote attackers to send crafted packets that can crash the service.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerability in the swctrl service, allowing unauthenticated remote attackers to send crafted packets that can crash the service.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-09-30T07:18:30.271Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8454", "state": "PUBLISHED", "dateUpdated": "2024-09-30T16:59:40.972Z", "dateReserved": "2024-09-05T02:53:07.051Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2024-09-30T07:18:30.271Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:planet:gs-4210-24p2s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "89C0B4AA-848F-4AAC-8C51-8C10AEF0630A", "versionEndExcluding": "3.305b240802", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:planet:gs-4210-24p2s:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "2A30964B-E6B8-4B8A-BE2E-882C0F3D8298", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:planet:gs-4210-24pl4c_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E17E272-4418-4CE7-8E59-44953D19D659", "versionEndExcluding": "2.305b240719", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:planet:gs-4210-24pl4c:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "F8029517-8FAB-4130-81F3-98BB09F4814E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerability in the swctrl service, allowing unauthenticated remote attackers to send crafted packets that can crash the service."}, {"lang": "es", "value": "El servicio swctrl se utiliza para detectar y administrar de forma remota los dispositivos de PLANET Technology. Algunos modelos de conmutadores tienen una vulnerabilidad de denegaci\u00f3n de servicio en el servicio swctrl, lo que permite que atacantes remotos no autenticados env\u00eden paquetes manipulados que pueden hacer que el servicio se bloquee."}], "id": "CVE-2024-8454", "lastModified": "2024-10-04T15:11:40.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "twcert@cert.org.tw", "type": "Secondary"}]}, "published": "2024-09-30T08:15:04.340", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/en/cp-139-8058-cc391-2.html"}, {"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-8057-1b3fa-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-476"}], "source": "twcert@cert.org.tw", "type": "Primary"}]}

{}