CVE-2025-32440: Critical Auth Bypass in NetAlertX

CVE-2025-32440 is a critical (CVSS 10.0) authentication bypass in NetAlertX, the network presence scanner and alert framework. Versions before 25.4.14 let unauthenticated requests reach sensitive functions in util.php and change settings. The fix is version 25.4.14. Upgrade, and keep the interface off untrusted networks.

What's affected

NetAlertX versions prior to 25.4.14, per the CVE record. The project patched the issue in 25.4.14, and its release page for that version is linked from the record.

The weakness is in how requests to /index.php are allowed to trigger functions in util.php. The record says an attacker can use crafted requests to update settings without logging in. The vector rates network access, low complexity, no privileges and no user interaction, with a changed scope, which is how the score reaches 10.0.

NetAlertX is a tool that watches a local network, so many installs sit on a home or office LAN. That lowers exposure only if the interface really is unreachable from anything you do not trust.

How to check if you're exposed

Find the version your instance is running. For a container install, list the image and tag, then compare it with 25.4.14:

docker ps --format '{{.Names}} {{.Image}}'

If you pinned a tag, read it from your compose file. If you track the latest tag, pull the image again and read the version shown in the web interface footer or settings page.

Then check who can reach the web port. If the port is published on a public address or forwarded through your router, treat the instance as exposed.

What to do now

1. Upgrade NetAlertX to 25.4.14 or later and restart the container or service.
2. Put the web interface behind a VPN or a reverse proxy that requires its own login, so the application is not the only gate.
3. Block the port from the internet at the firewall or router.
4. Review the settings and configuration after the upgrade, looking for changes you did not make, such as altered scan targets, notification endpoints or plugin options.
5. Add NetAlertX to the inventory of tools that need regular updates, since it holds a map of your network.

Why it matters

The class is CWE-306 (Missing Authentication for Critical Function). Functions that change settings were reachable without a check that the caller had logged in. Settings in a monitoring tool are powerful: they can redirect notifications, change what is scanned and alter how the tool talks to other systems.

A score of 10.0 does not mean the worst outcome is certain. It means the record shows no barrier to a remote caller and a wide impact once they get in. Closing the exposure with an upgrade is cheap compared with auditing what an open settings page could have changed.

The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.

Quick check

Sources

• CVE-2025-32440 record on Safeguard Gold
• NetAlertX release v25.4.14
• GitHub security advisory GHSA-h4x5-vr54-vjrx

Last reviewed: 18 October 2026.