CVE-2024-28140

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and observing the output.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-250

Affected software

No affected versions have been published.

Timeline

Published: Dec 11, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-281416.3The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing acti CVE-2024-281424.7Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other CVE-2024-281438.4The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account CVE-2024-281445.5An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-develo CVE-2024-281455.9An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters. CVE-2024-281468.4The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and CVE-2024-281477.4An authenticated user can upload arbitrary files in the upload function for collection preview images. An attacker may upload an HTML file CVE-2024-281484.3An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API r CVE-2024-281496.5Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure pe CVE-2024-28159.8A vulnerability classified as critical has been found in Tenda AC15 15.03.20_multi. Affected is the function R7WebsSecurityHandler of the fi CVE-2024-281504.7Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report fr CVE-2024-281514.3Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the con