CVE-2024-46257

A Command injection vulnerability in requestLetsEncryptSslWithDnsChallenge in NginxProxyManager 2.11.3 allows an attacker to achieve remote code execution via Add Let's Encrypt Certificate. NOTE: this is not part of any NGINX software shipped by F5.

CVSS v3.1 CNA

6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

1.33% chance of exploitation in the next 30 days, 71st percentile

Published

2024-09-27

Updated

2024-10-24

Proof-of-concept exploits (1)

• TranDongA3/Simulation_CVE-2024-462560★ · 2025-10-29

Security advisories

• NginxProxyManager/nginx-proxy-manager/pull/4073/commits/c39d5433bcd13993def222bbb2b6988bb…

References

• CVE Record
• NVD entry

Related

• CVE-2024-46256
• CVE-2025-1094
• CVE-2026-60137
• CVE-2026-63030