Paper/Archive/CVE-2024-46506

CVE-2024-46506

NetAlertX NetAlertX — NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesetting…

EPSS 63%public exploit CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 99.2.992 × 2019.8 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.

Affected

ProductAffectedFixed inSource

NetAlertX23.01.14 – < 24.10.1224.10.12CNA

Scores by source

mitre (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitrhinosecuritylabs.com/research/cve-2024-46506-rce-in-netalertx