CVE-2023-50159 is a high severity (CVSS 8.8) access control flaw in the ScaleFusion Windows desktop agent, version 10.5.2. Kiosk mode application restrictions can be bypassed, which can allow arbitrary code to be executed. The record says it is fixed in 10.5.7. Update the agent and review your kiosk profiles.
What's affected
- ScaleFusion Windows Desktop App agent 10.5.2, per the NVD record.
- Fixed in 10.5.7, which prevents launching the file explorer in agent based Multi-App and Single App Kiosk mode.
- The vendor advisory is slightly more specific: it says the fix shipped in agent versions 10.5.6 and 10.5.7, released on 1 December 2023. We read this as the fix landing in 10.5.6 and carried into 10.5.7, but the record's 10.5.7 is the safe target.
- Vendor and record disagree on framing. The vendor describes the issue as a result of a design choice, since file explorer was on the default allowed list for Multi-App Kiosk, and as misconfiguration in a related website blocking finding. NVD scores it 8.8 as an access control flaw.
- KEV status: the record shows kev as false.
How to check if you're exposed
Check the installed agent version on kiosk devices. In the ScaleFusion console, device details show the agent version. On a Windows endpoint you can also list it from PowerShell.
Get-Package | Where-Object Name -like "*Scalefusion*"
Any kiosk device running an agent older than 10.5.7 should be treated as exposed. Then review the device profile for Multi-App Kiosk: if your allowed apps need file explorer, the vendor says you must now add it explicitly.
What to do now
- Update the ScaleFusion MDM agent to 10.5.7 or later on every Windows kiosk device.
- After updating, test each kiosk profile. The vendor warns that apps which depend on File Explorer need it added to the allowed list.
- For website restrictions, follow the vendor advice: use modern management and the supplied browser policies for Chrome and Edge, not only the agent.
- Remove local administrator rights from kiosk user accounts and limit physical access to keyboards and USB ports where you can.
- Audit any kiosk that was publicly accessible for signs of unexpected software.
Why it matters
The weakness is CWE-284, improper access control. A kiosk works by restricting a user to a small set of allowed apps. If one allowed route opens a general purpose tool such as a file browser, a user can move from the allowed app to launching anything on the machine. The record states that this path allows arbitrary code to be executed.
Kiosks often sit in shops, lobbies and clinics where anyone can walk up and touch them. That makes restriction bypasses more serious than the score suggests on its own. The lesson is to treat the allow list as a security boundary and check what each allowed app can open.
Quick check
Is the fix in 10.5.6 or 10.5.7?
The NVD record says 10.5.7. The vendor advisory lists 10.5.6 and 10.5.7 as the releases of 1 December 2023. Use 10.5.7 or later to be safe.
Will updating break my kiosk apps?
It can. The vendor says File Explorer is now blocked by default, so add it to the allowed apps in the device profile if a permitted app needs it.
Sources
- NVD record for CVE-2023-50159
- Scalefusion security advisory for the Windows MDM agent
Last reviewed: 19 October 2026.
