What’s Vulnerable › Vulnerabilities

CVE-2024-2422: LenelS2 NetBox Improper Neutralization of Argumented Delimiters

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-30 · updated 2026-06-17
• Weakness: CWE-88

Description

LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands.

Affected products

• LenelS2 NetBox: before 5.6.2 — fixed in 5.6.2

How to fix

Upgrade to a fixed version: LenelS2 NetBox 5.6.2. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01
• https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01
• https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf

Get alerted when CVE-2024-2422 or the next vulnerability affects your stack