CVE-2024-48766

CVE-2024-48766 is an unauthenticated arbitrary file read (CWE-22 path traversal) in NetAlertX, a self-hosted network device monitoring and alerting tool, affecting releases from 24.7.18 up to but excluding 24.10.12. The flaw resides in components/logs.php: the application issues an HTTP redirect that is not actually enforced and validates the requested log path with a weak strpos()-based check, so a client that simply ignores the redirect can supply ../ traversal sequences and read arbitrary files accessible to the web server process. An attacker with network access to the web interface gains read access to sensitive host files such as configuration and credentials, with no authentication or user interaction required; the flaw is read-only and confers no direct code execution. Any NetAlertX deployment in the affected version range is vulnerable, but risk concentrates on instances exposed to untrusted networks such as the internet, since most installs run on internal LANs. The flaw has been exploited in the wild as of May 2025, a public Metasploit scanning module exists, and EPSS assigns a roughly 70% probability of exploitation within 30 days (99th percentile), although it is not yet listed in CISA KEV.

What to do: Upgrade to NetAlertX 24.10.12 or later; if you cannot upgrade immediately, restrict the NetAlertX web interface to trusted networks via firewall or VPN. Because this flaw allows unauthenticated reads, review web access logs for requests to components/logs.php containing ../ traversal sequences, and treat any internet-exposed instance in the affected range as potentially compromised, rotating any credentials or secrets readable from the host.