CVE-2024-2420
📋 TL;DR
CVE-2024-2420 is a critical authentication bypass vulnerability in LenelS2 NetBox access control systems due to hardcoded credentials. Attackers can gain unauthorized administrative access to physical security systems. Organizations using affected NetBox versions are at risk.
💻 Affected Systems
- LenelS2 NetBox
📦 What is this software?
Lenels2 Netbox by Honeywell
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of physical access control systems allowing unauthorized building entry, disabling alarms, and manipulating security logs.
Likely Case
Unauthorized access to security monitoring dashboards, manipulation of door access permissions, and potential data exfiltration.
If Mitigated
Limited impact if systems are isolated, monitored, and have additional authentication layers.
🎯 Exploit Status
Exploitation requires knowledge of hardcoded credentials but no authentication needed. Simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 5.6.2 or later
Vendor Advisory: https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf
Restart Required: Yes
Instructions:
1. Download NetBox version 5.6.2 or later from official LenelS2/Carrier sources. 2. Backup current configuration and database. 3. Install the update following vendor documentation. 4. Restart the NetBox service. 5. Verify functionality and monitor logs.
🔧 Temporary Workarounds
Network Isolation
allIsolate NetBox systems from untrusted networks and internet access
Configure firewall rules to restrict access to NetBox management interfaces
Access Control Lists
allImplement strict network ACLs to limit which IPs can access NetBox
Add firewall rules: allow only trusted management IPs to NetBox ports
🧯 If You Can't Patch
- Implement network segmentation to isolate NetBox systems from general network traffic
- Enable detailed logging and monitoring for authentication attempts and administrative actions
🔍 How to Verify
Check if Vulnerable:
Check NetBox version in administration interface or via system information. Versions 5.6.1 and earlier are vulnerable.Check Version:
Check NetBox web interface: System > About, or examine installation directory version filesVerify Fix Applied:
Verify version is 5.6.2 or later in administration interface. Test authentication with known credentials only.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful logins from unexpected IPs
- Administrative actions from non-standard accounts or IPs
Network Indicators:
- HTTP requests to NetBox authentication endpoints from unauthorized sources
- Unusual patterns of administrative API calls
SIEM Query:
source="netbox" AND (event_type="authentication" AND result="success") AND user!="expected_users"