← CVE Intelligence

CVE-2024-28138

OS Command Injection PUBLISHED

Description (CNA)

An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized.

Affected (CNA)

Vendor / productVersions
Image Access GmbH / Scan2Netaffected 0 before 7.40

CWE

CWE-78

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.