PT-2024-3978 · Lenels2 · Lenels2 Netbox

Claroty Team82 + 1 · Published 2024-03-13 · Updated 2026-02-02 · CVE-2024-2422

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LenelS2 NetBox versions prior to and including 5.6.1

Description The issue is related to an authenticated remote code execution (RCE) that allows an attacker to execute malicious commands. It is associated with the injection or modification of arguments, which can enable a remote attacker to execute arbitrary commands.

Recommendations For versions prior to and including 5.6.1, update to a version later than 5.6.1 to resolve the issue.

Fix

RCE

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2024-04393

CVE-2024-2422

Affected Products

Lenels2 Netbox

References · 8

• https://cisa.gov/news-events/ics-advisories/icsa-24-151-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-2422 · Vendor Advisory
• https://corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2422 · Security Note
• https://bdu.fstec.ru/vul/2024-04393 · Security Note
• https://t.me/cveNotify/150552 · Telegram Post
• https://claroty.com/team82/disclosure-dashboard/cve-2024-2422 · Note
• https://vuldb.com/ru/?id.266723 · Note