CVSS v3
10
CRITICAL
EPSS Score
91.5%
exploit probability
CISA KEV
No
known exploited
Exploitation
poc
SSVC status
NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.
NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.
A proof-of-concept exploit exists for CVE-2024-46506, but active exploitation has not been confirmed at this time.
CVE-2024-46506 has a CVSS v3 base score of 10 (CRITICAL severity), with vector string 3.1.
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
Ranked by exploit probability (EPSS).