CVE-2024-28140: medium-severity vulnerability in Image Access GmbH Scan2Net
Violation of Least Privilege Principle
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.3%
The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and observing the output.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Image Access GmbH · Scan2NetRelated CVEs — Image Access GmbH Scan2Net
In the same product, most dangerous first.
CVE-2024-47946HIGHOS Command Execution through Arbitrary File UploadEPSS 1.1%CVE-2024-28138HIGHOS Command InjectionEPSS 0.9%CVE-2024-28139HIGHPrivilege escalation through sudo misconfigurationEPSS 0.7%CVE-2024-36498MEDIUMStored cross site scriptingEPSS 0.6%CVE-2024-28145MEDIUMUnauthenticated SQL InjectionEPSS 0.5%CVE-2024-36494MEDIUMReflected Cross Site ScriptingEPSS 0.5%