by Kastro
Paper/Archive/CVE-2024-2422

CVE-2024-2422

LenelS2 NetBox — LenelS2 NetBox Improper Neutralization of Argumented Delimiters

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
37
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 44.2.442 × 208.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands.

Affected

ProductAffectedFixed inSource
NetBoxAll – 5.6.1–CNA
lenels2_netbox≤ 5.6.1–CISA-ADP

Scores by source

Carrier (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorycorporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdfrefcisa.gov/news-events/ics-advisories/icsa-24-151-01