CVE-2024-46506

Critical CVSS: 10.0

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.

Vendor

Netalertx

Product

Netalertx

CWE

CWE-306

Yayın Tarihi

2025-05-13 16:15:23

Güncelleme

2025-06-17 19:39:38

Source Identifier

cve@mitre.org

KEV Date Added

Kategoriler

CWE-306 Netalertx CRITICAL Netalertx 2025

Referanslar

https://rhinosecuritylabs.com/research/cve-2024-46506-rce-in-netalertx/ https://rhinosecuritylabs.com/research/cve-2024-46506-rce-in-netalertx/

Benzer Kayıtlar

Critical

CVE-2025-48952

NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentic…

Critical

CVE-2025-32440

NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the aut…

High

CVE-2024-48766

NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and…