CVE-2024-8451: Planet GS-4210-24P2S Firmware DOS Flaw

CVE-2024-8451 Overview

CVE-2024-8451 affects certain PLANET Technology switch models that fail to properly handle insufficiently authenticated SSH connection requests. Remote attackers can exploit this weakness to occupy available SSH connection slots. Once all slots are consumed, legitimate administrators lose access to the SSH management interface.

The flaw is classified under [CWE-280]: Improper Handling of Insufficient Permissions or Privileges. It affects the GS-4210-24P2S and GS-4210-24PL4C managed switches, which are widely deployed in enterprise and industrial networks. TWCERT published a coordinated advisory for this issue.

Critical Impact
Unauthenticated remote attackers can exhaust SSH connection slots, blocking legitimate administrators from managing affected PLANET switches over SSH.

Affected Products

PLANET Technology GS-4210-24P2S switch (hardware version 3.0) and firmware
PLANET Technology GS-4210-24PL4C switch (hardware version 2.0) and firmware
Additional PLANET switch models sharing the same SSH service implementation may be affected

Discovery Timeline

2024-09-30 - CVE-2024-8451 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8451

Vulnerability Analysis

The vulnerability resides in the SSH daemon running on affected PLANET switches. The service accepts incoming TCP connections on port 22 and reserves a connection slot before requiring complete authentication. Attackers can open many partially authenticated sessions and hold them open.

Because the switch enforces a finite maximum of concurrent SSH sessions, exhausting these slots prevents any new SSH session from being established. Administrators attempting to log in receive connection failures or timeouts. Existing sessions remain functional, but the management channel becomes unavailable for new users.

The underlying weakness is a resource management failure. The SSH service does not sufficiently constrain unauthenticated or partially authenticated connections by source, rate, or lifetime. This allows a single low-bandwidth attacker to disable the SSH management plane.

Root Cause

The root cause is improper handling of connection requests that have not completed authentication. The service treats pre-authentication connections as full sessions for the purpose of slot allocation. There is no enforced limit on unauthenticated connections per source address or per unit of time.

Attack Vector

The attack requires only network reachability to the SSH port on the switch. No credentials, user interaction, or prior access are needed. An attacker sends repeated SSH connection requests and delays completion of the key exchange or authentication phase. This holds each slot open until the switch's session table is full.

The vulnerability does not disclose data or allow code execution. Its impact is limited to availability of the SSH management service. TWCERT documents the flaw in its TWCERT Security Advisory.

Detection Methods for CVE-2024-8451

Indicators of Compromise

Sudden inability of administrators to establish new SSH sessions to a PLANET switch while ICMP and other management interfaces remain responsive
Elevated volume of inbound TCP connections to port 22 from one or a small set of external source addresses
SSH sessions that connect but never complete the authentication handshake, visible in switch logs or network flow data

Detection Strategies

Monitor SSH connection counts and connection states on network switches and correlate spikes with source IP diversity
Alert on repeated incomplete SSH handshakes to management interfaces of network infrastructure devices
Baseline normal administrative SSH activity and flag deviations in session establishment rates targeting switch management VLANs

Monitoring Recommendations

Ingest switch syslog and NetFlow or sFlow data into a centralized analytics platform to detect connection floods against port 22
Track failed and hanging SSH sessions to management IPs and generate alerts when concurrent connections approach the device limit
Cross-reference source IPs of anomalous SSH traffic against threat intelligence feeds for known scanners and botnets

How to Mitigate CVE-2024-8451

Immediate Actions Required

Restrict SSH management access to a dedicated management VLAN or trusted administrator subnets using ACLs on the switch and upstream firewalls
Block inbound TCP port 22 from untrusted networks and the public internet at perimeter devices
Contact PLANET Technology support to obtain firmware updates for the affected GS-4210-24P2S and GS-4210-24PL4C models

Patch Information

PLANET Technology has coordinated the disclosure through TWCERT. Refer to the TWCERT Security Advisory and the TWCERT Security Alert for vendor guidance and firmware availability. Administrators should apply the corrected firmware for their specific hardware revision as soon as it becomes available.

Workarounds

Disable the SSH service on affected switches and manage them over an out-of-band console or serial connection until firmware is updated
Enforce strict source IP allowlists for SSH access using switch access control lists
Deploy rate limiting for inbound TCP port 22 traffic on upstream routers or firewalls to slow connection exhaustion attempts

bash

# Example: restrict SSH access to a management subnet on upstream firewall
iptables -A INPUT -p tcp --dport 22 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW \
  -m recent --set --name SSH_MGMT
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW \
  -m recent --update --seconds 60 --hitcount 5 --name SSH_MGMT -j DROP
iptables -A INPUT -p tcp --dport 22 -j DROP