Description
Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password.
Related CPE's
Vulnerable
Vulnerable
References
https://www.twcert.org.tw/en/cp-139-8048-f0e4d-2.html
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-8047-adf79-1.html
Third Party Advisory
CVSS impact metrics
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
6.8 · Medium
CVSS V3.1
CVSS V3.0
CVSS V2.0
Information
Source identifier
Vulnerability status
Analyzed
Published
2024-09-30T07:15:03.937
1 week agoLast modified
2024-10-04T15:08:22.733
4 days ago