CVE-2024-8458

HIGH

PLANET GS-4210-24P2S and GS-4210-24PL4C Firmware - Cross-Site Request Forgery

Title source: llm

Description

Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker can trick a user into visiting a malicious website, allowing the attacker to impersonate the user and perform actions on their behalf, such as creating accounts.

References (2)

Core 2

Core References

Third Party Advisory third-party-advisory

https://www.twcert.org.tw/tw/cp-132-8065-579c1-1.html

Third Party Advisory third-party-advisory

https://www.twcert.org.tw/en/cp-139-8066-d6504-2.html

Scores

CVSS v3 8.8

EPSS 0.0027

EPSS Percentile 18.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-352

Status published

Products (2)

planet/gs-4210-24p2s_firmware < 3.305b240802

planet/gs-4210-24pl4c_firmware < 2.305b240719

Published Sep 30, 2024

Tracked Since Feb 18, 2026