CVE-2024-28140: Violation of Least Privilege Principle

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-11 · updated 2026-06-17
Weakness: CWE-250

Description

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and observing the output.

Affected products

Image Access GmbH Scan2Net: before 7.42 — fixed in 7.42

How to fix

Upgrade to a fixed version: Image Access GmbH Scan2Net 7.42. Check the vendor advisory for mitigations.

References

https://r.sec-consult.com/imageaccess
https://www.imageaccess.de/?page=SupportPortal&lang=en
http://seclists.org/fulldisclosure/2024/Dec/2

Get alerted when CVE-2024-28140 or the next vulnerability affects your stack