CVE-2024-28140CWE-250

Violation of Least Privilege Principle

Medium · published December 11, 2024

CVSS v3.1

6.1

EPSS

Percentile

21.7

In the wild

Unconfirmed

What it is

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and observing the output.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00301 · 21.7th percentile
Weakness: CWE-250 · Execution with Unnecessary Privileges
Published: 2024-12-11T15:48Z

EPSS history

Timeline

11 DEC 15:48Z
Violation of Least Privilege Principle
cvelistv5