CVE-2024-8458 Overview
CVE-2024-8458 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the web management interface of certain PLANET Technology managed switches. An unauthenticated remote attacker can craft a malicious web page that, when visited by an authenticated administrator, forces the browser to issue state-changing requests to the switch. The attacker can then impersonate the administrator and perform privileged actions, including creating new user accounts on the device. The flaw is tracked under CWE-352 and was published by TWCERT.
Critical Impact
A successful attack grants persistent administrative access to network switches, enabling traffic interception, configuration tampering, and lateral movement across the managed network segment.
Affected Products
- PLANET GS-4210-24P2S switch (hardware version 3.0) and associated firmware
- PLANET GS-4210-24PL4C switch (hardware version 2.0) and associated firmware
- Web management interface on the affected firmware builds
Discovery Timeline
- 2024-09-30 - CVE-2024-8458 published to NVD with TWCERT advisory references
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8458
Vulnerability Analysis
The affected PLANET switches expose a web-based administration interface that processes state-changing HTTP requests without verifying request origin. The application does not implement anti-CSRF tokens, does not validate the Origin or Referer headers, and relies solely on session cookies for authentication. Because browsers automatically attach session cookies to cross-origin requests targeting the switch, an attacker-controlled page can submit privileged form data on behalf of an authenticated administrator. The vulnerability requires user interaction, since the administrator must visit the malicious page while holding an active session against the switch.
Root Cause
The root cause is the absence of CSRF protections in the switch web application. Sensitive endpoints, including user-management functionality, accept requests that contain no unpredictable token tied to the user session. The application also fails to enforce same-origin request validation, which CWE-352 identifies as the canonical control for preventing forged requests from third-party origins.
Attack Vector
Exploitation occurs over the network and requires the administrator to load attacker-controlled content. The attacker hosts a page containing an auto-submitting HTML form or background fetch request targeting an administrative endpoint on the switch, such as the account creation handler. When the administrator visits the page from a browser with an active management session, the browser transmits the request along with the valid session cookie. The switch executes the action, for example provisioning a new administrator account that the attacker controls. No prior credentials and no direct network access to the switch are required, only the ability to lure the victim to a malicious URL.
No public proof-of-concept code or exploit module is available for this vulnerability. Refer to the TWCERT Security Advisory for vendor-supplied technical details.
Detection Methods for CVE-2024-8458
Indicators of Compromise
- Creation of unexpected administrator or user accounts on PLANET GS-4210-24P2S or GS-4210-24PL4C switches
- HTTP POST requests to the switch web interface where the Referer or Origin header points to an external, non-management domain
- Switch configuration changes correlated in time with administrator web browsing activity to untrusted sites
Detection Strategies
- Audit switch configuration and local user databases against a known-good baseline to identify unauthorized account additions
- Inspect web server access logs on the switch, where available, for state-changing requests originating from unexpected referrers
- Monitor egress proxy or DNS logs for administrator workstations accessing untrusted sites immediately before switch configuration changes
Monitoring Recommendations
- Forward syslog from PLANET switches to a centralized logging platform and alert on user creation, password changes, and privilege modifications
- Restrict administrative access to the switch web interface to a dedicated management VLAN reachable only from hardened jump hosts
- Review authentication events for new accounts logging in from unfamiliar source addresses following the patch window
How to Mitigate CVE-2024-8458
Immediate Actions Required
- Apply the firmware update published by PLANET Technology for the GS-4210-24P2S and GS-4210-24PL4C models as referenced in the TWCERT Security Advisory
- Audit all local accounts on affected switches and remove any unrecognized administrator or user entries
- Force a password reset for all switch administrator accounts and invalidate active management sessions
Patch Information
PLANET Technology has coordinated with TWCERT to publish remediation guidance. Administrators should consult the TWCERT Security Announcement and the vendor support portal for the specific firmware build that addresses CVE-2024-8458 on each affected model.
Workarounds
- Place the switch management interface on an isolated management network unreachable from user workstations that browse the public internet
- Require administrators to use a dedicated browser profile or hardened jump host for switch management, and to log out of the web UI immediately after each session
- Block access to the switch web interface from general-purpose endpoints using ACLs or host-based firewall rules until firmware is updated
# Example: restrict switch management access to a dedicated jump host using upstream ACL
# Replace 10.10.99.10 with the management jump host IP and 192.0.2.5 with the switch IP
access-list 150 permit tcp host 10.10.99.10 host 192.0.2.5 eq 80
access-list 150 permit tcp host 10.10.99.10 host 192.0.2.5 eq 443
access-list 150 deny tcp any host 192.0.2.5 eq 80
access-list 150 deny tcp any host 192.0.2.5 eq 443
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
