CVE-2024-28140 — Violation of Least Privilege Principle

CVE-2024-28140

Violation of Least Privilege Principle PUBLISHED

Description (CNA)

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and observing the output.

Affected (CNA)

Vendor / product	Versions
Image Access GmbH / Scan2Net	affected 0 before 7.42

CWE

CWE-250

References

https://r.sec-consult.com/imageaccess
https://www.imageaccess.de/?page=SupportPortal&lang=en

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2024/Dec/2