CVE-2024-2421

2024-05-3018:15:09

CWE-78

[email protected]

web.nvd.nist.gov

lenels2 netbox

unauthenticated rce

cve-2024-2421

elevated permissions

access control

event monitoring

security vulnerability

9.3 High

CVSS4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

7.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.7%

JSON

LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "NetBox",
    "vendor": "LenelS2",
    "versions": [
      {
        "lessThanOrEqual": "5.6.1",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  }
]