Lucene search

CarrierVULNRICHMENT:CVE-2024-2421

HistoryMay 30, 2024 - 5:24 p.m.

CVE-2024-2421 LenelS2 NetBox Improper Neutralization of Special Elements

2024-05-3017:24:33

CWE-78

Carrier

github.com

lenels2 netbox

rce

unauthenticated

elevated permissions

9.3 High

CVSS4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.7%

JSON

LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "NetBox",
    "vendor": "LenelS2",
    "versions": [
      {
        "lessThanOrEqual": "5.6.1",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-24-151-01

www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf

9.3 High

CVSS4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.7%

JSON

Related for VULNRICHMENT:CVE-2024-2421