CVE-2024-2421 is a critical OS command injection in LenelS2 NetBox, an access control and event monitoring system. NVD scores it 9.8 and CISA scores it 9.1. It affects versions up to and including 5.6.1, and CISA's advisory lists NetBox 5.6.2 as the fix.
What's affected
LenelS2 NetBox versions prior to and including 5.6.1. The CISA ICS advisory (ICSA-24-151-01) names NetBox 5.6.2 as the fixed release.
The two sources disagree on severity, so here are both. The NVD record gives CVSS 3.1 base score 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CISA advisory gives 9.1 under CVSS v3.1 and 9.3 under CVSS v4.0. Either way the rating is critical, and the CISA entry is the vendor-coordinated one.
The same advisory covers a second, authenticated flaw, CVE-2024-2422, which is a separate post.
How to check if you're exposed
NetBox is an appliance style product, so there is no package manager command to run. Open the product's version information in the administration interface and compare it with 5.6.2. Anything at or below 5.6.1 is in scope.
Then check reachability. The weakness is exploitable over the network without credentials, so the question that matters is whether the NetBox web interface can be reached from anywhere other than a tightly controlled management network. Ask your network team for firewall rules and any internet exposure scans covering the host.
What to do now
- Upgrade to NetBox 5.6.2 through an authorized installer, as the CISA advisory directs.
- Follow the hardening guide in the NetBox built-in help menu.
- Make sure the system is not reachable from the internet and sits behind a firewall, separated from the business network.
- If remote access is needed, use a VPN and keep the VPN itself updated.
- Review administrator accounts and recent activity on the system once it is patched, since a command injection runs with the application's elevated permissions.
Why it matters
The weakness is CWE-78, improper neutralization of special elements in an OS command. Input reaches a command that the system runs, and the system does not strip out the parts that change what the command does. The record says the result is command execution with elevated permissions, and because no login is needed, the attacker needs only network access.
Access control platforms matter more than their size suggests. They decide who can open doors, and they usually sit on a network that few people monitor closely. A takeover of the controller is a physical security problem as well as an IT one.
This CVE is not on the CISA Known Exploited Vulnerabilities list, and neither source I read says it has been exploited in the wild.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers open source dependencies in your own code. It does not scan appliance firmware, so for NetBox the vendor advisory is your guide.
Quick check
Is a fix available?
Yes. The CISA advisory lists NetBox 5.6.2 as the fixed version for versions up to and including 5.6.1.
Does an attacker need a login?
No. The record describes this one as unauthenticated. CVE-2024-2422 is the authenticated sibling.
Sources
- CISA ICS advisory ICSA-24-151-01
- NVD record for CVE-2024-2421
Last reviewed: 19 October 2026.
