CVE-2024-8454
📋 TL;DR
CVE-2024-8454 is a denial-of-service vulnerability in the swctrl service used by certain PLANET Technology switch models. Unauthenticated remote attackers can crash the service by sending specially crafted packets. Organizations using affected PLANET switch models are impacted.
💻 Affected Systems
- PLANET Technology switches with swctrl service
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent service disruption causing network outages, requiring physical device restart or reconfiguration.
Likely Case
Temporary service interruption affecting device management capabilities until service restarts.
If Mitigated
Minimal impact with proper network segmentation and monitoring to detect and block attack attempts.
🎯 Exploit Status
Crafting DoS packets requires minimal technical skill; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor firmware updates for specific models
Vendor Advisory: https://www.twcert.org.tw/en/cp-139-8058-cc391-2.html
Restart Required: Yes
Instructions:
1. Identify affected PLANET switch models. 2. Check vendor website for firmware updates. 3. Download and apply latest firmware. 4. Restart device to activate patch.
🔧 Temporary Workarounds
Disable swctrl service
allTurn off vulnerable service if not required for operations
Check device CLI/web interface for service management commands
Network segmentation
linuxRestrict access to swctrl service ports (default UDP 161, 162, 391)
iptables -A INPUT -p udp --dport 161 -j DROP
iptables -A INPUT -p udp --dport 162 -j DROP
iptables -A INPUT -p udp --dport 391 -j DROP
🧯 If You Can't Patch
- Implement strict network ACLs to block external access to swctrl ports
- Monitor network traffic for abnormal packet patterns targeting swctrl service
🔍 How to Verify
Check if Vulnerable:
Check device model and firmware version against vendor advisory; test service response to crafted packets.Check Version:
Check device web interface or CLI for firmware version (varies by model)Verify Fix Applied:
Verify firmware version is updated per vendor recommendations; test service stability under normal and attack simulation.📡 Detection & Monitoring
Log Indicators:
- swctrl service crash logs
- unexpected service restarts
- high volume of UDP packets to swctrl ports
Network Indicators:
- Spike in UDP traffic to ports 161, 162, 391
- Malformed packets targeting swctrl service
SIEM Query:
source_port=udp AND (dest_port=161 OR dest_port=162 OR dest_port=391) AND packet_size>threshold