CVE-2024-2420

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-259

Affected software

Vendor	Product	Versions
LenelS2	NetBox	>= All, <= 5.6.1
carrier	lenels2_netbox	<= 5.6.1

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01US Government Resource, Vendor Advisory
https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdfBroken Link
https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01US Government Resource, Vendor Advisory
https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdfBroken Link

Timeline

Published: May 30, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-242029.8An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 al CVE-2024-24219.8LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and includin CVE-2024-242139.8Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor CVE-2024-242155.3An issue in the component /cgi-bin/GetJsonValue.cgi of Cellinx NVT Web Server 5.0.0.014 allows attackers to leak configuration information v CVE-2024-242169.8Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/m CVE-2024-24228.8LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including CVE-2024-24236.4The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnera CVE-2024-242307.5Komm.One CMS 10.4.2.14 has a Server-Side Template Injection (SSTI) vulnerability via the Velocity template engine. It allows remote attacker CVE-2024-24247.5An input validation vulnerability exists in the Rockwell Automation 5015-AENFTXT that causes the secondary adapter to result in a major nonr CVE-2024-242457.8An issue in Canimaan Software LTD ClamXAV v3.1.2 through v3.6.1 and fixed in v.3.6.2 allows a local attacker to escalate privileges via the CVE-2024-242465.5Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/CVE-2024-24257.5A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploi