CVE-2024-46257

A Command injection vulnerability in requestLetsEncryptSslWithDnsChallenge in NginxProxyManager 2.11.3 allows an attacker to achieve remote code execution via Add Let's Encrypt Certificate. NOTE: this is not part of any NGINX software shipped by F5.

CVSS v3.1

6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

1.33% chance of exploitation in the next 30 days, 69th percentile

Published

2024-09-27

Updated

2024-10-24

Proof-of-concept exploits (1)

• TranDongA3/Simulation_CVE-2024-46256

References

• CVE Record
• NVD entry

Related

• CVE-2024-46256
• CVE-2025-1094
• CVE-2026-60137
• CVE-2026-63030
• CVE-2024-46258
• CVE-2024-46241