cvelist/2024/47xxx/CVE-2024-47946.json

{
    "data_version": "4.0",
    "data_type": "CVE",
    "data_format": "MITRE",
    "CVE_data_meta": {
        "ID": "CVE-2024-47946",
        "ASSIGNER": "security-research@sec-consult.com",
        "STATE": "PUBLIC"
    },
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content can be uploaded as desktop backgrounds or lock screens. After the upload, the PHP script is available in the web root. The PHP code executes once the uploaded file is accessed. This allows the execution of arbitrary PHP code and OS commands on the device as \"www-data\"."
            }
        ]
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                        "cweId": "CWE-434"
                    }
                ]
            }
        ]
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "Image Access GmbH",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Scan2Net",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_value": "not down converted",
                                            "x_cve_json_5_version_data": {
                                                "versions": [
                                                    {
                                                        "changes": [
                                                            {
                                                                "at": "7.42",
                                                                "status": "unaffected"
                                                            }
                                                        ],
                                                        "lessThan": "7.42",
                                                        "status": "affected",
                                                        "version": "0",
                                                        "versionType": "custom"
                                                    }
                                                ],
                                                "defaultStatus": "affected"
                                            }
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "references": {
        "reference_data": [
            {
                "url": "https://r.sec-consult.com/imageaccess",
                "refsource": "MISC",
                "name": "https://r.sec-consult.com/imageaccess"
            },
            {
                "url": "https://www.imageaccess.de/?page=SupportPortal&lang=en",
                "refsource": "MISC",
                "name": "https://www.imageaccess.de/?page=SupportPortal&lang=en"
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.2.0"
    },
    "source": {
        "discovery": "UNKNOWN"
    },
    "exploit": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory."
                }
            ],
            "value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory."
        }
    ],
    "solution": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "<span style=\"background-color: rgb(255, 255, 255);\">The vendor provides a firmware update to version 7.42, which can be downloaded via the vendor's customer server portal.</span><br>"
                }
            ],
            "value": "The vendor provides a firmware update to version 7.42, which can be downloaded via the vendor's customer server portal."
        }
    ],
    "credits": [
        {
            "lang": "en",
            "value": "Daniel Hirschberger (SEC Consult Vulnerability Lab)"
        },
        {
            "lang": "en",
            "value": "Tobias Niemann (SEC Consult Vulnerability Lab)"
        }
    ]
}