What’s Vulnerable › Vulnerabilities

CVE-2024-2421: LenelS2 NetBox Improper Neutralization of Special Elements

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-30 · updated 2026-06-17
• Weakness: CWE-78

Description

LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions.

Affected products

• LenelS2 NetBox: before 5.6.2 — fixed in 5.6.2

How to fix

Upgrade to a fixed version: LenelS2 NetBox 5.6.2. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01
• https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01
• https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf

Get alerted when CVE-2024-2421 or the next vulnerability affects your stack