Vulnerability · Published Dec 10, 2024 · Assigned by SEC-VLab
CVE-2024-28138OS Command Injection
High 7.3
In plain English
A high-severity OS command injection in Scan2Net from Image Access GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.9%top 38.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Image Access GmbH | Scan2Net | 0 – before 7.40 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L