{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2024-28140",
        "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
        "state": "PUBLISHED",
        "assignerShortName": "SEC-VLab",
        "dateReserved": "2024-03-05T09:15:40.201Z",
        "datePublished": "2024-12-11T15:48:22.287Z",
        "dateUpdated": "2025-11-03T21:54:23.530Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "affected",
                    "product": "Scan2Net",
                    "vendor": "Image Access GmbH",
                    "versions": [
                        {
                            "changes": [
                                {
                                    "at": "7.42",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThan": "7.42",
                            "status": "affected",
                            "version": "0",
                            "versionType": "custom"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "finder",
                    "value": "Daniel Hirschberger (SEC Consult Vulnerability Lab)"
                },
                {
                    "lang": "en",
                    "type": "finder",
                    "value": "Tobias Niemann (SEC Consult Vulnerability Lab)"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<div><div><div><div><p>The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user.&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">This can be confirmed by running \"ps aux\" as the root user and observing the output.</span></p></div></div></div></div><div></div>"
                        }
                    ],
                    "value": "The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running \"ps aux\" as the root user and observing the output."
                }
            ],
            "exploits": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory.<br>"
                        }
                    ],
                    "value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory."
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-233",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-233 Privilege Escalation"
                        }
                    ]
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-250",
                            "description": "CWE-250 Execution with Unnecessary Privileges",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
                "shortName": "SEC-VLab",
                "dateUpdated": "2024-12-11T15:48:22.287Z"
            },
            "references": [
                {
                    "tags": [
                        "third-party-advisory"
                    ],
                    "url": "https://r.sec-consult.com/imageaccess"
                },
                {
                    "tags": [
                        "patch"
                    ],
                    "url": "https://www.imageaccess.de/?page=SupportPortal&lang=en"
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<span style=\"background-color: rgb(255, 255, 255);\">The vendor provides a firmware update to version 7.42 (or higher) which can be downloaded via the vendor's customer server portal.</span><br>"
                        }
                    ],
                    "value": "The vendor provides a firmware update to version 7.42 (or higher) which can be downloaded via the vendor's customer server portal."
                }
            ],
            "source": {
                "discovery": "UNKNOWN"
            },
            "title": "Violation of Least Privilege Principle",
            "x_generator": {
                "engine": "Vulnogram 0.2.0"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "cvssV3_1": {
                            "scope": "UNCHANGED",
                            "version": "3.1",
                            "baseScore": 6.1,
                            "attackVector": "PHYSICAL",
                            "baseSeverity": "MEDIUM",
                            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                            "integrityImpact": "HIGH",
                            "userInteraction": "NONE",
                            "attackComplexity": "LOW",
                            "availabilityImpact": "NONE",
                            "privilegesRequired": "NONE",
                            "confidentialityImpact": "HIGH"
                        }
                    },
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2024-12-11T17:19:48.898302Z",
                                "id": "CVE-2024-28140",
                                "options": [
                                    {
                                        "Exploitation": "poc"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2024-12-11T17:26:17.781Z"
                }
            },
            {
                "title": "CVE Program Container",
                "references": [
                    {
                        "url": "http://seclists.org/fulldisclosure/2024/Dec/2"
                    }
                ],
                "providerMetadata": {
                    "orgId": "af854a3a-2127-422b-91ae-364da2661108",
                    "shortName": "CVE",
                    "dateUpdated": "2025-11-03T21:54:23.530Z"
                }
            }
        ]
    }
}