PT-2024-22288 · Unknown · Image Access Scan2Net

Daniel Hirschberger + 1 · Published 2024-12-05 · Updated 2024-12-11 · CVE-2024-28138

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Image Access Scan2Net versions (affected versions not specified)

Description An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg events.php" script as the www-data user. The HTTP GET parameter data is not properly sanitized. This allows an attacker to inject arbitrary code on the target system.

Recommendations As a temporary workaround, consider disabling the "msg events.php" script until a patch is available. Restrict access to the data parameter in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-28138

Affected Products

Image Access Scan2Net

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-28138 · Security Note
• https://imageaccess.de/?page=SupportPortal&lang=en · Patch
• https://twitter.com/oktsec/status/1864605029274927550 · Twitter Post
• https://r.sec-consult.com/imageaccess · Note
• http://seclists.org/fulldisclosure/2024/Dec/2 · Note
• https://twitter.com/CVEnew/status/1866432906765258980 · Twitter Post
• https://t.me/cvedetector/12484 · Telegram Post
• https://t.me/cvenotify/103697 · Telegram Post