CVE-2024-46506: Netalertx

Critical severity, CVSS 10.0. EPSS: 62.4% chance of exploitation in the next 30 days.

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.

Affected products

• Netalertx Netalertx: from 23.01.14, before 24.10.12 (fixed in 24.10.12)

Published 2025-05-13. Last modified 2026-06-17.