CVE-2024-28143: Insecure Password Change Function

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-12 · updated 2026-06-17
Weakness: CWE-620

Description

The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user without knowing the old password, e.g. by exploiting a CSRF issue.

Affected products

Image Access GmbH Scan2Net: before 7.40 — fixed in 7.40

How to fix

Upgrade to a fixed version: Image Access GmbH Scan2Net 7.40. Check the vendor advisory for mitigations.

References

https://r.sec-consult.com/imageaccess
https://www.imageaccess.de/?page=SupportPortal&lang=en
http://seclists.org/fulldisclosure/2024/Dec/2

Get alerted when CVE-2024-28143 or the next vulnerability affects your stack