CVE-2024-8456

9.8 criticalEPSS 0.6%

Critical (9.8) in planet. EPSS 0.6% chance of exploitation in the next 30 days.

Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2024-09-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

planet:gs-4210-24p2s_firmware
planet:gs-4210-24pl4c_firmware

References

https://www.twcert.org.tw/en/cp-139-8062-92f17-2.html
https://www.twcert.org.tw/tw/cp-132-8061-91872-1.html

Check your stack JSON