CVE-2024-46506

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.

CVSS v3.1

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

62.04% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-306

Published

2025-05-13

Proof-of-concept exploits (1)

• https://rhinosecuritylabs.com/research/cve-2024-46506-rce-in-netalertx/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-46506.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/netalertx_rce_cve_202…

References

• CVE Record
• NVD entry

Related

• CVE-2024-4650
• CVE-2024-46507
• CVE-2024-4649
• CVE-2024-4651
• CVE-2024-46486
• CVE-2024-4652