CVE-2023-51748 affects the ScaleFusion Windows MDM Agent 10.5.2. In Edge kiosk mode, keyboard shortcuts Ctrl-O and Ctrl-S let a user break out of the restricted app. The record rates it High at 8.8 and says it is fixed in 10.5.7. The vendor's advisory names 10.5.6 and 10.5.7.
What's affected
The record names ScaleFusion 10.5.2 on Windows, and says the issue is fixed in 10.5.7 by preventing the file explorer from launching in Agent based Multi-App and Single App Kiosk mode.
The vendor advisory gives a slightly different picture. It lists the agent versions that carry the fix as 10.5.6 and 10.5.7, released on 1 December 2023. Both sources agree that 10.5.2 is affected and that 10.5.7 is safe, so use 10.5.7 or later if you can.
The vendor also calls these findings a misconfiguration or documented limitation in some cases. In its explanation, File Explorer was on the default allowed list for Multi-App Kiosk mode as a design choice, and it is now blocked by default.
The record gives a CVSS score of 8.8 (High). The CVSS vector reads as follows. The attack needs local access to the system, and the complexity is low. A low-privilege account is needed. No user interaction is required. Impact on confidentiality is high, on integrity high, and on availability high. The weakness class is CWE-693.
How to check if you're exposed
Open the ScaleFusion agent on a kiosk device, or check your Scalefusion dashboard, and read the Windows MDM Agent version. Anything at 10.5.2, or below the fixed builds, should be updated.
Then review your device profiles. The vendor says that if you have allowed applications that need File Explorer, you must now add File Explorer to the allowed apps in the device profile. Checking this avoids breaking a kiosk that needs it.
What to do now
- Inventory kiosk devices that use the ScaleFusion Windows MDM Agent and note their versions.
- Update the agent to 10.5.7 or later. The vendor advisory also lists 10.5.6 as a fixed release.
- Review kiosk device profiles after the update, and add File Explorer to the allowed apps only where a kiosk really needs it.
- Test one device in each profile type before rolling out fleet wide.
- Where you can, use modern management with website allow listing rules, which the vendor recommends.
Why it matters
A kiosk is a promise: a device that can only do one job. If a user can press a keyboard shortcut and reach a file dialog, they can see the file system and may reach other programs. The record classifies this as a protection mechanism failure, and the scope change in the vector reflects that the impact reaches beyond the kiosk app itself.
Public kiosks in retail, healthcare, and education tend to sit in places where anyone can walk up to them. The attacker is physically at the keyboard, which explains the local vector, but the device may hold credentials or reach internal networks.
The vendor's position matters here. It argues that the behaviour came from a default configuration and not a coding error. Whatever the label, the safe response is the same: update and tighten the profile.
Quick check
Is 10.5.7 or 10.5.6 the fixed version?
The record says 10.5.7. The vendor advisory lists 10.5.6 and 10.5.7 as the releases carrying the fix. Use 10.5.7 or later to satisfy both.
Does the vendor consider this a vulnerability?
It describes the findings as misconfigurations or documented limitations in some cases, while still shipping a change that blocks File Explorer by default.
Sources
Last reviewed: 19 October 2026.
