CVE-2023-51749 affects ScaleFusion 10.5.2 on Windows. Users of the Edge kiosk can start a search from a tooltip and leave the allowed content. The record rates it High at 8.8, but the vendor says it is not vulnerable with the default Windows device profile, which uses modern management and website allow listing.
What's affected
The record names ScaleFusion 10.5.2 on Windows. It carries a note that the vendor's position is that the product is not vulnerable if the default Windows device profile is used, which relies on modern management with website allow listing rules.
The vendor advisory explains its reasoning. Allow and block rules for websites are provided by modern management. A device enrolled only through the MDM Agent, without modern management enabled, does not get those rules, and that is the setup in which the researcher was able to open sites that were not allowed.
The record does not name a fixed version for this specific CVE, and the sources describe it as a configuration matter. Check the vendor advisory for the current guidance.
The record gives a CVSS score of 8.8 (High). The CVSS vector reads as follows. The attack needs local access to the system, and the complexity is low. A low-privilege account is needed. No user interaction is required. Impact on confidentiality is high, on integrity high, and on availability high. The record lists no CWE.
How to check if you're exposed
Check how each kiosk device was enrolled. In the Scalefusion dashboard, look at the device profile and confirm whether modern management is enabled and whether website allow listing rules are configured for the kiosk.
Also confirm the Windows MDM Agent version. Anything still on 10.5.2 should be updated, since other CVEs in the same advisory were addressed in later builds.
What to do now
- List Windows kiosk devices and their enrolment method.
- Turn on modern management with website allow listing for kiosk profiles, as the vendor describes.
- Update the Windows MDM Agent from 10.5.2 to the latest release.
- Test that the tooltip search no longer opens pages outside the allow list.
- Read the vendor advisory for any version specific guidance, since the record does not name a fix.
Why it matters
The weakness is a gap between what a kiosk is supposed to allow and what the interface lets a user reach. A tooltip with a search action is a small door, but any way to start a web search from inside a locked browser lets a visitor leave the approved pages.
This CVE shows why a dispute between a researcher and a vendor does not remove the need for action. The record scores it at 8.8 while the vendor says the default profile is not affected. Both can be true if your devices are configured in a particular way, so the useful question is how your own devices are enrolled.
If your kiosks run the default profile with allow listing, your exposure is lower. If they were enrolled with the agent alone, treat the bypass as real.
Quick check
Is this a true vulnerability or a configuration issue?
The score in the record is High, while the vendor says it is not vulnerable under the default profile with modern management. Check your own setup to see which applies.
Does the record name a fixed version?
No. Use the vendor advisory and the latest agent release.
Sources
Last reviewed: 19 October 2026.
