NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://rhinosecuritylabs.com/research/cve-2024-46506-rce-in-netalertx/ | Exploit Third Party Advisory |
| https://rhinosecuritylabs.com/research/cve-2024-46506-rce-in-netalertx/ | Exploit Third Party Advisory |
Configurations
History
17 Jun 2025, 19:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://rhinosecuritylabs.com/research/cve-2024-46506-rce-in-netalertx/ - Exploit, Third Party Advisory | |
| First Time |
Netalertx netalertx
Netalertx |
|
| CPE | cpe:2.3:a:netalertx:netalertx:*:*:*:*:*:*:*:* |
13 May 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-13 16:15
Updated : 2025-06-17 19:39
NVD link : CVE-2024-46506
Mitre link : CVE-2024-46506
JSON object : View
Products Affected
netalertx
- netalertx
CWE
No CWE.