CVE-2024-46506 Command injection in NetAlertX

Critical 10.0 Published 13 May 2025 Updated 13 May 2025

Unauthenticated attackers can execute arbitrary commands via the settings update function in NetAlertX, leading to full system compromise.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-46506?

CVE-2024-46506 is a critical command injection vulnerability in NetAlertX, published on 13 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.

Weakness: CWE-306

Which versions are affected by CVE-2024-46506?

It affects 1 product.

Products include Netalertx Netalertx.

How do I fix CVE-2024-46506?

No fix has been published for CVE-2024-46506 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-46506 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-46506 exists.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 1 proofs of concept on GitHub.

Sources

Also known as GHSA-3qp4-7wm4-9hhr.