CVEvulnerability

CVE-2024-46506

10.0 CRITICAL Published 2025-05-13 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-05-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-306

Description

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.

Affected configurations

• netalertx netalertx (>= 23.01.14 < 24.10.12)

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References