Scan2Net vulnerabilities
5 known vulnerabilities in Scan2Net from Image Access. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.4 High severity
Scan2Net: Use of Hard-coded Credentials
The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allow a direct connection to the database server of the affected device.
- 8.4 High severity
Scan2Net: Unverified Password Change
The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user
- 8.8 High severity
Scan2Net: Execution with Unnecessary Privileges
The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as root without a password. Therefore, the privileges can be escalated to the root user. The risk has been accepted by the vendor and won't be f
- 7.2 High severity
Scan2Net: Unrestricted Upload of File with Dangerous Type
If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content can be uploaded as desktop backgrounds or lock screens. After the upload, the PHP script is available
- 7.3 High severity
Scan2Net: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized.