CVE-2024-2420 is a critical (9.8) hardcoded credentials flaw in LenelS2 NetBox through 5.6.1 that lets an attacker bypass authentication. CISA lists 5.6.2 as the fixed release. Upgrade through your authorized installer and keep the system off the internet. NVD published it on 2024-05-30.
Weakness: CWE-259 (Use of Hard-coded Password).
What's affected
- Affected: LenelS2 NetBox access control and event monitoring system, versions through 5.6.1.
- Fixed: 5.6.2, per CISA advisory ICSA-24-151-01 (released 30 May 2024).
- Attack conditions:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Network reachable, no privileges and no user interaction.
The CISA advisory also lists two related flaws in the same product, CVE-2024-2421 (OS command injection) and CVE-2024-2422 (argument injection), and credits Noam Moshe of Claroty Team82 with the reports. The advisory also gives CVSS v4.0 scores, 9.3 for this issue, alongside the 9.8 v3.1 score.
How to check if you're exposed
- Sign in to NetBox and open the About or system information page to read the version. Anything through 5.6.1 is affected.
- Confirm whether the web interface is reachable from outside the control network.
- Review the NetBox hardening guide in the product's built-in help.
- Ask your installer which version each site runs.
What to do now
- Schedule the upgrade to 5.6.2 with your authorized LenelS2 installer.
- Take NetBox off the internet and limit its network exposure, as CISA recommends.
- Place control system networks behind firewalls and separate them from business networks.
- Use an updated VPN for remote access.
- Follow the NetBox hardening guide in the built-in help and review accounts and access logs.
Why it matters
The record classes this as CWE-259 (Use of Hard-coded Password). A hardcoded credential is a password or key built into the product, so every installation shares it. Once anyone learns it, the login screen no longer protects any of them, and it cannot be rotated by a customer without a vendor update.
NVD and CISA both score it 9.8 (Critical) under CVSS v3.1. CISA reports no known public exploitation of these vulnerabilities, and the record's KEV flag is false. Access control systems guard physical doors, so a software flaw can have physical consequences.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2024-2420?
LenelS2 NetBox 5.6.2, per CISA advisory ICSA-24-151-01.
Is it exploited in the wild?
CISA's advisory says it received no reports of known public exploitation. The record's KEV flag is false.
Sources
- CVE-2024-2420 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2420, as held in the batch record
- CISA advisory ICSA-24-151-01
- Carrier product security advisory (PDF), linked from the record
Last reviewed: 19 October 2026.
