CVE-2024-46506

NetAlertX, an open-source network device monitoring tool, fails to require authentication for the function=savesettings operation exposed via its web interface (settings.php and util.php), enabling unauthenticated command injection (CWE-306). An attacker with network access to the web UI can send a crafted settings-update request that injects and executes arbitrary operating-system commands on the host, yielding unauthenticated remote code execution. All versions from 23.01.14 through 24.x before 24.10.12 are affected, with greatest risk to instances reachable from untrusted networks such as the internet. Exploitation has been observed in the wild in May 2025, a public proof-of-concept is available from Rhino Security Labs, and EPSS is high (62% probability of exploitation within 30 days).

What to do: Upgrade to NetAlertX 24.10.12 or later. Until patched, restrict access to the web UI (settings.php and util.php), e.g., via an authenticating reverse proxy or firewall rules, since the savesettings function requires no login. Given observed in-the-wild exploitation in May 2025, review instances for signs of compromise such as unexpected settings changes or unfamiliar processes/commands run by the application.