CVE-2024-46506: NetAlertX unauthenticated command injection in settings update

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable command injection with a CVSS of 10, documented in-the-wild exploitation, and very high EPSS.

What it is

NetAlertX versions 23.01.14 through 24.x before 24.10.12 expose a settings update function (function=savesettings) that lacks an authentication requirement, allowing unauthenticated command injection. Because the flaw is reachable over the network with no credentials, it is a severe pre-auth remote code execution risk for exposed instances.

Impact

An unauthenticated attacker can execute arbitrary commands on the host running NetAlertX, leading to full compromise of the application and its underlying system.

Attack surface

Reachable over the network via the settings update endpoint (settings.php/util.php) with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

The description states it was exploited in the wild in May 2025, and a public exploit write-up is referenced; it is not listed in CISA KEV, while EPSS is high at roughly 0.62 (99th percentile).

What to do

• Upgrade NetAlertX to 24.10.12 or later, which is the first fixed version per the record.
• If immediate patching is not possible, remove internet exposure and restrict access to the NetAlertX web interface to trusted networks only.
• Require authentication and authorization on the savesettings function and audit other administrative endpoints for the same missing-auth pattern.
• Run the NetAlertX service with least privilege and isolate it from sensitive internal networks.

Detection

• Monitor web logs for requests to settings.php or util.php invoking function=savesettings, especially from unauthenticated or unexpected source IPs.
• Alert on suspicious child processes spawned by the NetAlertX web server or service account (shell, curl, wget, nc).
• Review host and application logs for command-injection indicators and unexpected outbound connections from the NetAlertX host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.