VULNERABILITY INTELLIGENCE

CVE-2024-8455

CVSS score8.1 HIGH
EPSS probability0.34%
CISA KEVNot currently listed
Published2024-09-30
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords.

Weakness classification

  • CWE-261: Weak Encoding for Password
  • CWE-326: Inadequate Encryption Strength

Primary references