CVE-2024-46506
Critical
Description
NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.
SeverityCritical
CVSS10.0
Exploit probability—
ProductNetalertx
PublishedMay 13, 2025
First seenMay 13, 2025
Weakness typeCWE-306Missing authentication for critical function
How to fix
Update
- netalertx netalertx24.10.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netalertx netalertx | 23.01.14 ≤ v < 24.10.12 | 24.10.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.