CVE-2024-2422

The vulnerability classified as CWE-88 (argument injection/injection into argument) allows an attacker to inject malicious arguments or commands in the location where the NetBox application processes input data and passes it to system calls or external processes. An attacker with access to an authenticated session can prepare an appropriate request containing a malicious payload that will be executed with the privileges of the application process at the operating system level.

Successful exploitation of the vulnerability enables an attacker to execute arbitrary system commands on the NetBox server, which may lead to complete system takeover, theft of configuration data, and disruption of physical access control infrastructure operations.

Patches available from the manufacturer should be applied according to references (Carrier security advisory CARR-PSA-2024-01 and CISA bulletin ICS-Advisory ICSA-24-151-01). It is recommended to update LenelS2 NetBox system to a version newer than 5.6.1 and restrict access to the administrative interface exclusively to trusted networks and authorized users.

Honeywell LenelS2 NetBox — versions up to 5.6.1 inclusive