by Kastro
Paper/Archive/CVE-2024-2421

CVE-2024-2421

LenelS2 NetBox — LenelS2 NetBox Improper Neutralization of Special Elements

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.4.444 × 208.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions.

Affected

ProductAffectedFixed inSource
NetBoxAll – 5.6.1–CNA
lenels2_netbox≤ 5.6.1–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Carrier (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorycorporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdfrefcisa.gov/news-events/ics-advisories/icsa-24-151-01