CVE-2024-28146

Description

The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allow a direct connection to the database server of the affected device.

Reserved 2024-03-05 | Published 2024-12-12 | Updated 2024-12-13 | Assigner SEC-VLab

Problem types

CWE-798 Use of Hard-coded Credentials

Product status

Default status
affected

Any version before 7.42
affected

Credits

Daniel Hirschberger (SEC Consult Vulnerability Lab) finder

Tobias Niemann (SEC Consult Vulnerability Lab) finder

References

r.sec-consult.com/imageaccess third-party-advisory

www.imageaccess.de/?page=SupportPortal&lang=en patch

cve.org (CVE-2024-28146)

nvd.nist.gov (CVE-2024-28146)

Download JSON