cbcvebase.
CVE-2024-46506
published 2025-05-13

CVE-2024-46506: NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an…

PriorityP195critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
50.23%
98.8th percentile
NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.

Affected

1 ranges
VendorProductVersion rangeFixed in
netalertxnetalertx>= 23.01.14 < 24.10.1224.10.12

Detection & IOCsextracted from sources · hover to see the quote

url/php/server/util.php↗
commandfunction=savesettings&settings=[["DBCLNP","DBCLNP_RUN","string","schedule"],["DBCLNP","DBCLNP_CMD","string","{{marker}}"],["DBCLNP","DBCLNP_RUN_SCHD","string","* * * * *"]]↗
commandfunction=addToExecutionQueue&action={{uuid}}|cron_restart_backend↗
url/api/table_settings.json↗
path/php/server/settings.php↗
otherfunction=savesettings↗
  • →Detect unauthenticated POST requests to /php/server/util.php with the body parameter function=savesettings — no authentication headers required, indicating exploitation attempt. ↗
  • →Look for POST requests to /php/server/util.php with function=addToExecutionQueue and a pipe character (|) in the action parameter, which is used to chain the cron_restart_backend command after injecting a payload. ↗
  • →Monitor for writes to DBCLNP_CMD setting via savesettings, particularly with cron-schedule strings (DBCLNP_RUN_SCHD: * * * * *), indicating an attacker scheduling arbitrary command execution. ↗
  • →Use FOFA/Shodan fingerprint title="netalertx" to identify exposed NetAlertX instances for proactive asset identification and patching prioritization. ↗
  • →A Metasploit module exists for this CVE; monitor for exploitation patterns consistent with the module's HTTP request sequence against /php/server/util.php. ↗
  • →Confirm exploitation by checking GET /api/table_settings.json for unexpected or attacker-controlled values in DBCLNP_CMD, which persists the injected command. ↗
  • ·The vulnerability is exploited via two sequential unauthenticated POST requests to util.php — first to inject a command via savesettings, then to trigger execution via addToExecutionQueue. Detection logic must account for this two-step attack chain. ↗
  • ·The injected command is executed via a cron-like scheduler (DBCLNP_RUN_SCHD: * * * * *), meaning payload execution may be delayed by up to one minute after the initial settings injection request. ↗
  • ·This vulnerability was actively exploited in the wild as of May 2025; treat any NetAlertX instance below version 24.10.12 as critically exposed. ↗

CVSS provenance

nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vulncheck10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.