PT-2024-32908 · Image Access Gmbh · Scan2Net

Daniel Hirschberger + 1 · Published 2024-12-10 · Updated 2024-12-20 · CVE-2024-47946

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software name or versions are mentioned in the provided descriptions.

Description The issue allows for remote code execution if an attacker has access to a valid Poweruser session. This is possible because specially crafted valid PNG files with injected PHP content can be uploaded as desktop backgrounds or lock screens. After the upload, the PHP script is available in the web root. The PHP code executes once the uploaded file is accessed, allowing the execution of arbitrary PHP code and OS commands on the device as "www-data".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-47946

Affected Products

Scan2Net

References · 8

• https://imageaccess.de/?page=SupportPortal&lang=en · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-47946 · Security Note
• https://twitter.com/CVEnew/status/1866432905477505133 · Twitter Post
• https://r.sec-consult.com/imageaccess · Note
• http://seclists.org/fulldisclosure/2024/Dec/2 · Note
• https://t.me/cvedetector/12485 · Telegram Post
• https://t.me/cvenotify/103698 · Telegram Post
• https://t.me/cvenotify/105207 · Telegram Post