CVE-2024-46506

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.

Affected products

Netalertx

Netalertx

< 24.10.12

CVSS 3.1

10.0 CRITICAL

EPSS

62.6% (99th percentile)

Weakness

CWE-306

NVD status

Analyzed

Published

2025-05-13