CVE-2024-2420CWE-259

LenelS2 NetBox Hardcoded Credentials

High · published May 30, 2024

CVSS v4.0
8.8
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

⚡ A set of hardcoded credentials in LenelS2 NetBox could let attackers waltz right past authentication like they own the place! 🔑 Think of it as a hotel where the master key is left behind the reception desk, waiting for anyone to grab it. Anyone who finds it can unlock every room without a trace! This vulnerability allows an attacker to bypass authentication entirely, potentially giving them full access to sensitive control features. Imagine an unauthorized person gaining entry and messing with security settings or monitoring events—definitely a scenario you do not want to play out!

Put simply

Think of it as a hotel where the master key is left behind the reception desk, waiting for anyone to grab it. Anyone who finds it can unlock every room without a trace! The hardcoded credentials in versions 5.6.1 and earlier allow attackers to authenticate without proper authorization, exposing the system to unauthorized control and monitoring access.

What to do

This vulnerability allows an attacker to bypass authentication entirely, potentially giving them full access to sensitive control features. Imagine an unauthorized person gaining entry and messing with security settings or monitoring events—definitely a scenario you do not want to play out! Upgrade immediately to version 5.6.2 or later to eliminate this risk. Review all configurations to ensure that no hardcoded credentials are left behind, and audit any access logs for suspicious activity. 🛡️ You've got this! Keep your defenses strong and enjoy peace of mind. 💪✨

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00505 · 42.3th percentile
Weakness
CWE-259 · Use of Hard-coded Password
Published
2024-05-30T17:22Z
EPSS history
Timeline
  • 30 MAY 17:22Z
    LenelS2 NetBox Hardcoded Credentials
    cvelistv5