What’s Vulnerable › Vulnerabilities

CVE-2024-47946: OS Command Execution through Arbitrary File Upload

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-10 · updated 2026-06-17
• Weakness: CWE-434

Description

If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content can be uploaded as desktop backgrounds or lock screens. After the upload, the PHP script is available in the web root. The PHP code executes once the uploaded file is accessed. This allows the execution of arbitrary PHP code and OS commands on the device as "www-data".

Affected products

• Image Access GmbH Scan2Net: before 7.42 — fixed in 7.42

How to fix

Upgrade to a fixed version: Image Access GmbH Scan2Net 7.42. Check the vendor advisory for mitigations.

References

• https://r.sec-consult.com/imageaccess
• https://www.imageaccess.de/?page=SupportPortal&lang=en
• http://seclists.org/fulldisclosure/2024/Dec/2

Get alerted when CVE-2024-47946 or the next vulnerability affects your stack