IRISPowerscan default accounts and untrusted scripts
Scanner software with guessable built-in logins lets intruders in.
Summary
IRISPowerscan ships with default accounts that have predictable credentials, so an attacker with access to an installation can log in and change application data and settings. Weak restrictions on scripts also let an authenticated user run code with the rights of the Windows user running IRISPowerscan.
Affected when
- Version 12.3 or older
- Predictable default account credentials left in place
- Authenticated user with access to script functionality
What to do
Check that you run a version newer than 12.3, and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Sources
- Advisory: canon-europe.com (opens in a new tab)
Times
First published
First seen