What’s Vulnerable › Vulnerabilities

CVE-2024-2420: LenelS2 NetBox Hardcoded Credentials

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-30 · updated 2026-06-17
• Weakness: CWE-259

Description

LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements.

Affected products

• LenelS2 NetBox: before 5.6.2 — fixed in 5.6.2

How to fix

Upgrade to a fixed version: LenelS2 NetBox 5.6.2. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01
• https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01
• https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf

Get alerted when CVE-2024-2420 or the next vulnerability affects your stack