by Kastro
Paper/Archive/CVE-2024-2420

CVE-2024-2420

LenelS2 NetBox — LenelS2 NetBox Hardcoded Credentials

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 43.2.432 × 208.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements.

Affected

ProductAffectedFixed inSource
NetBoxAll – 5.6.1–CNA
lenels2_netbox≤ 5.6.1–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Carrier (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcorporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdfrefcisa.gov/news-events/ics-advisories/icsa-24-151-01