CVE-2024-28143
High
Description
The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user without knowing the old password, e.g. by exploiting a CSRF issue.
SeverityHigh
CVSS8.4
Exploit probability—
ProductScan2Net
PublishedDec 12, 2024
First seenDec 12, 2024
Weakness typeCWE-620CWE-620
How to fix
Update
- Image Access GmbH Scan2Net7.40 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Image Access GmbH Scan2Net | v < 7.40 | 7.40 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.