Translated with AI from the Russian original.
Attackers could gain administrative access to the device or disrupt its operation
PT SWARM specialists discovered five vulnerabilities in the IGS-5225-8P2T4S industrial switch from the Taiwanese company Planet Technology. The danger level was assessed at 6.7–8.7 out of 10 on the CVSS 4.0 scale.
Three vulnerabilities affected the device's web interface. Their exploitation could lead to full control over the switch's operating system or denial of service. Another flaw was related to an undocumented debugging command, and the fifth was due to an insufficiently robust password hashing algorithm, which simplified brute-forcing them upon obtaining the relevant data.
Attacks required network access to the device and an active account. Depending on the vulnerability, ordinary user or administrator rights might be needed.
Within industrial control systems (ICS), compromising a switch can disrupt communication between programmable controllers, SCADA systems, and other equipment. This can deprive operators of up-to-date data and remote control capabilities, and in some cases, lead to production shutdown.
Planet has released patches. For the first version of the device, which is no longer supported, firmware v1.2412b260707 is available. Owners of the second version need to install v2.2412b260519 or newer. Before updating, experts recommend restricting network access to the web interface and command line, and abandoning Telnet.
