CVE-2024-8458— PLANET Technology switch devices - Cross-site Request Forgery
Quick assessment
Affected
PLANET Technology GS-4210-24PL4C hardware 2.0
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PLANET switch devices是中国PLANET公司的一系列交换器设备。 PLANET switch devices存在跨站请求伪造漏洞，该漏洞源于Web应用程序容易受到跨站请求伪造攻击，攻击者可以诱使用户访问恶意网站，从而冒充用户并代表其执行操作。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-8458
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PLANET Technology switch devices - Cross-site Request Forgery
Source: CVE Program / CVE List V5
Vulnerability Description
Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker can trick a user into visiting a malicious website, allowing the attacker to impersonate the user and perform actions on their behalf, such as creating accounts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
PLANET switch devices 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PLANET switch devices是中国PLANET公司的一系列交换器设备。 PLANET switch devices存在跨站请求伪造漏洞，该漏洞源于Web应用程序容易受到跨站请求伪造攻击，攻击者可以诱使用户访问恶意网站，从而冒充用户并代表其执行操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PLANET Technology | GS-4210-24PL4C hardware 2.0 | 0 ~ 2.305b240719 | - |
|
| PLANET Technology | GS-4210-24P2S hardware 3.0 | 0 ~ 3.305b240802 | - |
|
II. Public POCs for CVE-2024-8458
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-8458
请登录查看更多情报信息。
Same Patch Batch · PLANET Technology · 2024-09-30 · 12 CVEs total
| CVE-2024-8456 | 9.8 CRITICAL | PLANET Technology switch devices - Missing Authentication for multiple HTTP routes |
| CVE-2024-8448 | 8.8 HIGH | PLANET Technology switch devices - Remote privilege escalation using hard-coded credential |
| CVE-2024-8450 | 8.6 HIGH | PLANET Technology switch devices - Hard-coded SNMPv1 read-write community string |
| CVE-2024-8455 | 8.1 HIGH | PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords |
| CVE-2024-8452 | 7.5 HIGH | PLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials |
| CVE-2024-8451 | 7.5 HIGH | PLANET Technology switch devices - SSH server DoS attack |
| CVE-2024-8459 | 7.2 HIGH | PLANET Technology switch devices - Cleartext storage of SNMPv3 users' passwords |
| CVE-2024-8449 | 6.8 MEDIUM | PLANET Technology switch devices - Local users' passwords recovery through hard-coded cred |
| CVE-2024-8454 | 5.3 MEDIUM | PLANET Technology switch devices - Swctrl service DoS attack |
| CVE-2024-8453 | 4.9 MEDIUM | PLANET Technology switch devices - Weak hash for users' passwords |
| CVE-2024-8457 | 4.8 MEDIUM | PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Managemen |
IV. Related Vulnerabilities
Same product: GS-4210-24PL4C hardware 2.0
-
CVE-2024-8459
PLANET Technology switch devices - Cleartext storage of SNMP -
CVE-2024-8457
PLANET Technology switch devices - Stored cross-site scripti -
CVE-2024-8456
PLANET Technology switch devices - Missing Authentication fo -
CVE-2024-8455
PLANET Technology switch devices - Swctrl service exchanges -
CVE-2024-8454
PLANET Technology switch devices - Swctrl service DoS attack
Same vendor: PLANET Technology
-
CVE-2025-9972
Planet Technology｜Industrial Cellular Gateway - OS Command I -
CVE-2025-9971
Planet Technology｜Industrial Cellular Gateway - Missing Auth -
CVE-2025-46275
Planet Technology Network Products Missing Authentication fo -
CVE-2025-46274
Planet Technology Network Products Use of Hard-coded Credent -
CVE-2025-46273
Planet Technology Network Products Use of Hard-coded Credent
Same weakness: CWE-352
-
CVE-2026-39718
WordPress Wallstreet theme <= 2.8.6 - Cross Site Request For -
CVE-2026-104452
YesWiki before 4.6.7 CSRF Attachment Deletion via filemanage -
CVE-2026-104453
YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action -
CVE-2026-104451
YesWiki before 4.6.7 CSRF Page Revision Restore via Revision -
CVE-2026-104448
YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage H
V. Comments for CVE-2024-8458
No comments yet