CVE-2024-48766CWE-698
NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos…
High · published May 13, 2025
Patch now
High probability of exploitation
CVSS calls it high at 8.6. It sits in the 99.3th percentile for exploit probability.
What it is
NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos and directory traversal, as exploited in the wild in May 2025. This is related to components/logs.php.
The record
Technical detail
- CVSS v3.1
- 8.6 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.67909 · 99.3th percentile
- Weakness
- CWE-698 · Execution After Redirect (EAR)
- Published
- 2025-05-13T00:00Z
EPSS history
Timeline