CVE-2024-28144: Broken Access Control

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-12 · updated 2026-06-17
Weakness: CWE-384

Description

An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session management. If two users access the web interface from the same IP they are logged in as the other user.

Affected products

Image Access GmbH Scan2Net: through 7.42B

References

https://r.sec-consult.com/imageaccess
https://www.imageaccess.de/?page=SupportPortal&lang=en
http://seclists.org/fulldisclosure/2024/Dec/2

Get alerted when CVE-2024-28144 or the next vulnerability affects your stack