CVE-2024-8455
📋 TL;DR
CVE-2024-8455 allows attackers to intercept authentication tokens used by PLANET Technology's swctrl service and crack them to obtain plaintext passwords. This affects certain PLANET switch models that use weak encoding for authentication. Attackers can gain unauthorized access to network devices.
💻 Affected Systems
- PLANET Technology switches with swctrl service
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to network switches, enabling network disruption, data interception, lateral movement, and persistent backdoor installation.
Likely Case
Unauthorized access to switch management interfaces leading to configuration changes, network monitoring, and credential harvesting.
If Mitigated
Limited impact if network segmentation isolates management interfaces and strong authentication controls are in place.
🎯 Exploit Status
Requires packet interception capability but uses straightforward cryptographic attacks on weak encoding.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check PLANET Technology firmware updates
Vendor Advisory: https://www.twcert.org.tw/en/cp-139-8060-f3955-2.html
Restart Required: Yes
Instructions:
1. Check PLANET Technology website for firmware updates. 2. Download appropriate firmware for your switch model. 3. Backup current configuration. 4. Apply firmware update via web interface or CLI. 5. Verify service is updated and functioning.
🔧 Temporary Workarounds
Disable swctrl service
allDisable the vulnerable service if not required for remote management
Check device documentation for service disable commands
Network segmentation
allIsolate switch management interfaces from untrusted networks
🧯 If You Can't Patch
- Implement strict network access controls to limit swctrl service exposure
- Monitor network traffic for unauthorized access attempts to switch management interfaces
🔍 How to Verify
Check if Vulnerable:
Check if device uses swctrl service and verify firmware version against vulnerable models in TW-CERT advisoriesCheck Version:
show version (CLI) or check web interface system informationVerify Fix Applied:
Verify firmware has been updated to latest version and test authentication token strength📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts
- Unauthorized configuration changes
- Unusual swctrl service access
Network Indicators:
- Unusual traffic to switch management ports
- Packet capture showing swctrl protocol interception
SIEM Query:
source_ip=switch_management_interface AND (event_type=auth_failure OR protocol=swctrl)