CVE-2024-46506

CRITICAL EXPLOITED NUCLEI

Unauthenticated RCE in NetAlertX

Title source: metasploit

Description

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.

Exploits (2)

nomisec WORKING POC
by fufu-byte · remote
https://github.com/fufu-byte/CVE-2024-46506
metasploit WORKING POC EXCELLENT
by Chebuya (Rhino Security Labs), Takahiro Yokoyama · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/netalertx_rce_cve_2024_46506.rb

Nuclei Templates (1)

NetAlertX 23.01.14–24.x < 24.10.12 - Remote Code Execution
CRITICALVERIFIEDby s4e-io
FOFA: title="netalertx"

References (1)

Scores

CVSS v3 10.0
EPSS 0.9149
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Details

VulnCheck KEV 2025-05-13
CWE
CWE-306
Status published
Products (1)
netalertx/netalertx 23.01.14 - 24.10.12
Published May 13, 2025
Tracked Since Feb 18, 2026