The PLANET IGS-5225-8P2T4S industrial managed switch versions prior to 1.2412b260707 (V1) and 2.2412b260519 (V2) employ MD5-based password hashing, which is cryptographically weak. An attacker with access to the device's configuration file can exploit this weakness to recover the privileged-mode password, potentially gaining elevated access. The CVSS 4.0 vector indicates local attack vector with low complexity and no user interaction required, but privileges are required to initiate the attack. No known exploits are reported in the wild.

An attacker who obtains the device configuration file can recover the privileged-mode access password due to the use of MD5 hashing, which compromises the confidentiality of privileged credentials. This could lead to unauthorized privileged access to the device. However, the attack requires local access to the configuration file and privileged user rights to initiate.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to device configuration files and consider upgrading firmware to versions at or above 1.2412b260707 for V1 and 2.2412b260519 for V2 if available.