CVE-2024-2422 is a high severity argument injection in LenelS2 NetBox that lets a logged in user run commands. NVD and CISA both score it 8.8 under CVSS 3.1. It affects versions up to and including 5.6.1. CISA's advisory names NetBox 5.6.2 as the fix.
What's affected
LenelS2 NetBox versions prior to and including 5.6.1. The fixed release in the CISA ICS advisory (ICSA-24-151-01) is 5.6.2.
On severity, the sources agree on the v3.1 number. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which means network reachable, low complexity, low privileges needed and no user interaction. CISA also lists a CVSS v4.0 score of 8.7.
This advisory also covers CVE-2024-2421, an unauthenticated command injection scored 9.8 by NVD and 9.1 by CISA.
How to check if you're exposed
NetBox is a vendor appliance, so check it through the product. Find the installed version in the administration interface and compare it with 5.6.2. Anything at or below 5.6.1 is affected.
Next, list who holds an account. This flaw needs a valid login, so the number of accounts, the strength of their credentials and whether accounts are shared all change your real risk. Also confirm whether the web interface is reachable from outside the management network.
What to do now
- Upgrade to NetBox 5.6.2 through an authorized installer.
- Apply the hardening guide in the built-in help menu.
- Keep the system off the internet and behind a firewall, separate from business networks.
- Use a VPN for any remote access and keep it updated.
- Remove unused accounts and rotate passwords for the ones that remain.
Why it matters
The weakness is CWE-88, improper neutralization of argument delimiters in a command. In plain terms, the application builds a command line using input from a user, and a crafted value can add arguments the developer did not intend. The record says this leads to execution of malicious commands.
Authentication lowers the bar less than people hope. Credentials get reused, phished and shared, and a low privilege account is enough here. Pair it with the unauthenticated bug in the same advisory and the best answer is the same for both: patch and restrict the network path.
The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
For code you build yourself, Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks open source packages against known vulnerabilities. It does not cover appliances like NetBox.
Quick check
Do I need to be logged in to use this flaw?
Yes. The record calls it an authenticated remote code execution, and the vector requires low privileges.
What version fixes it?
NetBox 5.6.2, according to the CISA advisory.
Sources
- CISA ICS advisory ICSA-24-151-01
- NVD record for CVE-2024-2422
Last reviewed: 19 October 2026.
