CVE-2024-8452: Planet GS-4210-24P2S Information Disclosure

CVE-2024-8452 Overview

CVE-2024-8452 affects PLANET Technology switch models that support only obsolete cryptographic algorithms in their Simple Network Management Protocol version 3 (SNMPv3) implementation. The weak authentication and encryption protocols allow network-based attackers to recover SNMPv3 credentials in plaintext. Attackers who capture SNMPv3 traffic can break the legacy authentication or privacy algorithms and extract management credentials. This vulnerability falls under [CWE-327: Use of a Broken or Risky Cryptographic Algorithm].

Critical Impact

A remote, unauthenticated attacker who observes SNMPv3 traffic can recover plaintext credentials, gaining administrative visibility into network switch configurations.

Affected Products

• PLANET Technology GS-4210-24P2S switch (hardware version 3.0) and associated firmware
• PLANET Technology GS-4210-24PL4C switch (hardware version 2.0) and associated firmware
• SNMPv3 service on affected switch models

Discovery Timeline

• 2024-09-30 - CVE-2024-8452 published to the National Vulnerability Database
• 2024-10-04 - Last updated in NVD database

Technical Details for CVE-2024-8452

Vulnerability Analysis

The affected PLANET switches expose SNMPv3 but restrict the supported authentication and privacy protocols to algorithms now considered obsolete. SNMPv3 negotiates an authentication protocol (such as HMAC-MD5 or HMAC-SHA-1) and an encryption protocol (such as DES or 3DES) during USM-based session setup. When only weak primitives are available, the user has no option to enforce modern alternatives like SHA-256 or AES-256.

An attacker positioned to capture SNMPv3 frames can perform offline brute-force or cryptanalytic attacks against the captured authentication digests and encrypted payloads. Successful recovery yields plaintext SNMPv3 credentials, which expose configuration data and network topology managed through the switch.

The vulnerability impacts confidentiality directly. Integrity and availability are not affected by the cryptographic weakness itself, though recovered credentials can subsequently be used for further actions.

Root Cause

The SNMPv3 service implementation supports only legacy authentication primitives such as HMAC-MD5-96 and HMAC-SHA-1-96, paired with deprecated encryption like CBC-DES. These algorithms no longer meet current cryptographic standards. The firmware does not offer SHA-2 family digests or AES-based privacy protocols.

Attack Vector

The attack requires network access to observe SNMPv3 traffic between a management host and the affected switch. No authentication or user interaction is required. The attacker captures SNMPv3 packets through passive sniffing on a span port, ARP spoofing, or compromise of an adjacent device. The attacker then runs offline attacks against the weak authentication hashes and DES-encrypted payloads to recover the SNMPv3 username, authentication key, and privacy key.

No public proof-of-concept exploit is listed in the enriched data. For technical details refer to the TWCA Security Advisory and the TWCA Security Alert.

Detection Methods for CVE-2024-8452

Indicators of Compromise

• SNMPv3 sessions negotiated with usmHMACMD5AuthProtocol, usmHMACSHA1AuthProtocol, or usmDESPrivProtocol on affected switches
• Unexpected SNMP GET or SET requests from hosts outside the documented management subnet
• Packet captures showing sustained passive SNMP traffic collection on switch uplinks
• New or modified SNMPv3 users appearing in switch configuration without change-control records

Detection Strategies

• Inventory PLANET GS-4210-24P2S and GS-4210-24PL4C devices and audit which SNMPv3 authentication and privacy algorithms each device negotiates
• Capture SNMP traffic at aggregation points and flag sessions using MD5, SHA-1, or DES primitives
• Compare configured SNMPv3 users on switches against an authoritative source of truth and alert on drift

Monitoring Recommendations

• Forward switch syslog and SNMP authentication failure events to a centralized log platform for correlation
• Monitor for ARP spoofing and port mirroring changes on switches carrying management traffic
• Alert on SNMP traffic originating from any source outside the dedicated management VLAN

How to Mitigate CVE-2024-8452

Immediate Actions Required

• Restrict SNMP access to a dedicated management VLAN and apply ACLs that permit only authorized management hosts
• Disable SNMPv3 on affected switches if the protocol is not required for operations
• Rotate all SNMPv3 authentication and privacy keys after applying mitigations, assuming prior capture is possible
• Contact PLANET Technology for firmware updates that add modern authentication and privacy algorithms

Patch Information

No specific vendor patch URL is included in the enriched data. Review the TWCA Security Advisory for vendor guidance and firmware availability for the GS-4210-24P2S and GS-4210-24PL4C platforms.

Workarounds

• Replace SNMPv3 with an out-of-band management channel protected by TLS or SSH where supported
• Place switch management interfaces behind a jump host accessible only via VPN with multi-factor authentication
• Use the longest practical SNMPv3 passphrases to slow offline cracking of legacy authentication digests
• Segment management traffic from production traffic to limit passive capture opportunities

# Configuration example - restrict SNMP access via ACL on the management interface
# Replace 10.10.10.0/24 with your authorized management subnet
access-list 10 permit 10.10.10.0 0.0.0.255
snmp-server community-acl 10

# Remove SNMPv3 users that rely on weak primitives until firmware is updated
no snmp-server user <username> <group> v3 auth md5 <pass> priv des <pass>