PT-2024-3980 · Lenels2 · Lenels2 Netbox

Claroty Team82 + 1 · Published 2024-03-13 · Updated 2026-02-02 · CVE-2024-2420

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LenelS2 NetBox versions prior to and including 5.6.1

Description The issue is related to hardcoded credentials in the LenelS2 NetBox access control and event monitoring system. This allows an attacker to bypass authentication requirements. The exploitation of this issue may enable a remote attacker to circumvent the authentication procedure.

Recommendations For versions prior to and including 5.6.1, update to a version later than 5.6.1 to resolve the issue. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-259

Related Identifiers

BDU:2024-04395

CVE-2024-2420

Affected Products

Lenels2 Netbox

References · 8

• https://cisa.gov/news-events/ics-advisories/icsa-24-151-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-2420 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04395 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-2420 · Security Note
• https://corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf · Note
• https://t.me/cveNotify/150550 · Telegram Post
• https://vuldb.com/ru/?id.266725 · Note
• https://claroty.com/team82/disclosure-dashboard/cve-2024-2420 · Note