CVE-2024-28140

MEDIUM

Image Access GmbH Scan2Net < 7.42 - Unnecessary Privilege Escalation via Root-Level Browser Execution

Title source: llm

Description

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and observing the output.

References (3)

Core 3

Core References

Mailing List

http://seclists.org/fulldisclosure/2024/Dec/2

Various Sources third-party-advisory

https://r.sec-consult.com/imageaccess

Various Sources patch

https://www.imageaccess.de/?page=SupportPortal&lang=en

Scores

CVSS v3 6.1

EPSS 0.0029

EPSS Percentile 20.6%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-250

Status published

Products (1)

Image Access GmbH/Scan2Net < 7.42

Published Dec 11, 2024

Tracked Since Feb 18, 2026