Vulnerability · Published Dec 12, 2024 · Assigned by SEC-VLab
CVE-2024-28146Hardcoded credentials
High 8.4
In plain English
A high-severity hard-coded credentials in Scan2Net from Image Access GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.3%top 81.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allow a direct connection to the database server of the affected device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Image Access GmbH | Scan2Net | 0 – before 7.42 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H