CVE-2024-28138

An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized.

Score

CVSS 3.1 7.3 High

Status

Deferred - 551230f0-3615-47bd-b7cc-93e92e730bbf

Published

2024-12-10

Last modified

2025-11-03

Weaknesses

CWE-78

Affected products

• Scan2net (Image Access Gmbh)

References

• https://r.sec-consult.com/imageaccess
• https://www.imageaccess.de/?page=SupportPortal&lang=en
• http://seclists.org/fulldisclosure/2024/Dec/2