Platform
other
Component
netalertx
Fixed in
24.10.12
CVE-2024-46506 represents a critical Command Injection vulnerability affecting NetAlertX versions 23.01.14 through 24.10.12. This flaw allows unauthenticated attackers to inject and execute arbitrary commands on the system. The vulnerability stems from a lack of authentication requirements within the savesettings function, specifically impacting settings.php and util.php. A fix is available in version 24.10.12.
The impact of CVE-2024-46506 is severe. An attacker can leverage this vulnerability to gain complete control over a vulnerable NetAlertX instance. This includes executing arbitrary system commands, potentially leading to data exfiltration, system compromise, and lateral movement within the network. The ability to execute commands without authentication significantly broadens the attack surface, making it a high-priority risk. The vulnerability has already been exploited in the wild, indicating an active threat landscape.
CVE-2024-46506 is actively exploited in the wild, as confirmed in May 2025. This significantly elevates the risk associated with this vulnerability. While no specific threat actor groups have been publicly attributed to the exploitation, the ongoing activity underscores the need for immediate remediation. The vulnerability has been published by NVD on 2025-05-13. No KEV listing is currently available.
Exploit Status
EPSS
91.48% (100% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-46506 is to immediately upgrade NetAlertX to version 24.10.12 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict network access to the settings.php and util.php files to only trusted sources. Implement strict input validation and sanitization on all user-supplied data used in the savesettings function. While a WAF might offer some protection, it is not a substitute for patching. After upgrading, verify the fix by attempting to access the settings.php endpoint with a crafted payload designed to trigger command injection; the request should be rejected.
Update NetAlertX to version 24.10.12 or later. This version fixes the unauthenticated command injection vulnerability. The update will prevent attackers from executing arbitrary commands on your system.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-46506 is a critical vulnerability allowing unauthenticated command execution in NetAlertX versions 23.01.14–24.10.12 due to a missing authentication check in the settings update process.
You are affected if you are running NetAlertX versions 23.01.14 through 24.10.12 and have not yet upgraded to a patched version.
Upgrade NetAlertX to version 24.10.12 or later to resolve the vulnerability. If immediate upgrade is not possible, implement temporary workarounds like restricting network access to sensitive files.
Yes, CVE-2024-46506 is being actively exploited in the wild, making it a high-priority security concern.
Refer to the official NetAlertX security advisory for detailed information and updates regarding CVE-2024-46506.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.