CVE-2024-2422
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary commands on LenelS2 NetBox access control and event monitoring systems. Organizations using NetBox versions 5.6.1 and earlier are affected, potentially compromising physical security systems.
💻 Affected Systems
- LenelS2 NetBox
📦 What is this software?
Lenels2 Netbox by Honeywell
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to disable physical access controls, manipulate security logs, and pivot to other network systems.
Likely Case
Unauthorized access to physical facilities, data exfiltration, and disruption of security monitoring capabilities.
If Mitigated
Limited impact if proper network segmentation and authentication controls prevent exploitation attempts.
🎯 Exploit Status
Exploitation requires valid credentials but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.6.2 or later
Vendor Advisory: https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf
Restart Required: Yes
Instructions:
1. Download NetBox 5.6.2 or later from LenelS2 support portal. 2. Backup current configuration and database. 3. Run installer with administrative privileges. 4. Restart NetBox services. 5. Verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate NetBox systems from general network access
Authentication Hardening
allImplement multi-factor authentication and strong password policies
🧯 If You Can't Patch
- Implement strict network access controls to limit NetBox access to authorized IPs only
- Enable detailed logging and monitoring for suspicious authentication and command execution attempts
🔍 How to Verify
Check if Vulnerable:
Check NetBox version in web interface under Help > About or via Windows Services consoleCheck Version:
sc query "NetBox" | findstr /i "display_name"Verify Fix Applied:
Confirm version is 5.6.2 or later and test authentication and command functionality📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns
- Command execution in application logs
- Multiple failed login attempts followed by successful login
Network Indicators:
- Unusual outbound connections from NetBox server
- Traffic to unexpected ports
SIEM Query:
source="netbox" AND (event_type="command_execution" OR auth_failure_count>5)