VulnerabilityDeferred

CVE-2024-28140

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window.

MEDIUM 6.1EPSS 0.30%

Does this matter?

Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.

Description

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and observing the output.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.30% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-250
Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

References

https://r.sec-consult.com/imageaccess
https://www.imageaccess.de/?page=SupportPortal&lang=en
http://seclists.org/fulldisclosure/2024/Dec/2

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.