CVE-2024-47946
OS Command Execution through Arbitrary File Upload
Severity Score
7.2
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content can be uploaded as desktop backgrounds or lock screens. After the upload, the PHP script is available in the web root. The PHP code executes once the uploaded file is accessed. This allows the execution of arbitrary PHP code and OS commands on the device as "www-data".
*Credits:
Daniel Hirschberger (SEC Consult Vulnerability Lab), Tobias Niemann (SEC Consult Vulnerability Lab)
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-10-07 CVE Reserved
- 2024-12-10 CVE Published
- 2024-12-11 EPSS Updated
- 2024-12-20 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
- CAPEC-153: Input Data Manipulation
References (2)
| URL | Tag | Source |
|---|---|---|
| https://r.sec-consult.com/imageaccess | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.imageaccess.de/?page=SupportPortal&lang=en | 2024-12-10 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Image Access GmbH Search vendor "Image Access GmbH" | Scan2Net Search vendor "Image Access GmbH" for product "Scan2Net" | < 7.42 Search vendor "Image Access GmbH" for product "Scan2Net" and version " < 7.42" | en |
Affected
| ||||||