CVE-2024-48766 Details
Description
NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos and directory traversal, as exploited in the wild in May 2025. This is related to components/logs.php.
An unauthenticated arbitrary file read vulnerability has been identified in NetAlertX versions 24.7.18 prior to 24.10.12. The issue arises in the logs.php component, where an HTTP client can bypass authentication and exploit a directory traversal vulnerability to read sensitive files, such as the passwd file.
Users can upgrade to NetAlertX version 24.10.12 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://rhinosecuritylabs.com/research/cve-2024-46506-rce-in-netalertx/ | CISA-ADP | ExploitMitigationThird Party Advisory |
| https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/netalertx_file_read.rb | [email protected] | Exploit |
| https://rhinosecuritylabs.com/research/cve-2024-46506-rce-in-netalertx/ | [email protected] | ExploitMitigationThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-698 | Execution After Redirect (EAR) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netalertx netalertx | >= 24.7.18, < 24.10.12 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 24, 2025 | Reanalysis | [email protected] |
| Jun 23, 2025 | Initial Analysis | [email protected] |
| May 13, 2025 | CVE Modified | CISA-ADP |
| May 13, 2025 | CVE Modified | [email protected] |
| May 13, 2025 | New CVE Received | [email protected] |