CVE-2024-46506

🗓️ 13 May 2025 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 90 Views🌐 WEB

Unauthenticated command injection in NetAlertX settings update allows exploitation in May 2025.

Reporter	Title	Published	Views	Family All 20
GithubExploit	Exploit for Missing Authentication for Critical Function in Netalertx	27 Dec 202522:07	–	githubexploit
BDU FSTEC	The vulnerability of the saveSettings() function in the settings.php script of the NetAlert X intrusion notification network infrastructure allows a intruder to execute arbitrary code.	11 Mar 202500:00	–	bdu_fstec
Circl	CVE-2024-46506	30 Jan 202512:03	–	circl
CNNVD	NetAlertX 安全漏洞	13 May 202500:00	–	cnnvd
CNNVD	NetAlertX 安全漏洞	13 May 202500:00	–	cnnvd
Cvelist	CVE-2024-46506	13 May 202500:00	–	cvelist
Metasploit	NetAlertX File Read Vulnerability	25 Feb 202518:53	–	metasploit
Metasploit	Unauthenticated RCE in NetAlertX	11 Feb 202518:55	–	metasploit
Nuclei	NetAlertX 23.01.14–24.x < 24.10.12 - Remote Code Execution	28 Jun 202615:08	–	nuclei
NVD	CVE-2024-46506	13 May 202516:15	–	nvd

NVD

Vulners

Node

netalertx netalertxRange23.01.14–24.10.12

[
  {
    "defaultStatus": "unaffected",
    "product": "NetAlertX",
    "vendor": "NetAlertX",
    "versions": [
      {
        "lessThan": "24.10.12",
        "status": "affected",
        "version": "23.01.14",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
rhinosecuritylabs	www.rhinosecuritylabs.com/research/cve-2024-46506-rce-in-netalertx/

Parameter	Position	Path	Description	CWE
function	request body	php/server/util.php	Unauthenticated savesettings endpoint enables command injection via misconfigured settings update.	CWE-306
settings	request body	php/server/util.php	Unauthenticated savesettings endpoint enables command injection via misconfigured settings update.	CWE-306
DBCLNP_CMD	request body	php/server/util.php	Unauthenticated savesettings endpoint enables command injection via misconfigured settings update.	CWE-306
DBCLNP_RUN	request body	php/server/util.php	Unauthenticated savesettings endpoint enables command injection via misconfigured settings update.	CWE-306
DBCLNP_RUN_SCHD	request body	php/server/util.php	Unauthenticated savesettings endpoint enables command injection via misconfigured settings update.	CWE-306

17 Jun 2026 07:55Current

9.9High risk

Vulners AI Score9.9

CVSS 3.110

EPSS0.50233

SSVC

CWE-306