LenelS2 NetBox
Act Now9.8ICS-CERT ICSA-24-151-01May 30, 2024
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
LenelS2 NetBox versions prior to 5.6.2 contain hardcoded credentials (CWE-259) and command injection vulnerabilities (CWE-78, CWE-88) that allow an attacker to bypass authentication and execute malicious commands with elevated permissions. Successful exploitation could compromise the integrity and availability of physical access control systems.
What this means
What could happen
An attacker could bypass authentication and execute arbitrary commands on the NetBox access control system with elevated privileges, potentially disabling access control enforcement or altering facility entry/exit permissions.
Who's at risk
Building access control systems operators and facility managers. Any organization using LenelS2 NetBox for physical security and access control should prioritize this vulnerability. Affected systems manage entry/exit points and are critical to facility security perimeter operations.
How it could be exploited
An attacker on the network sends a crafted request to the NetBox system that bypasses authentication checks due to hardcoded credentials or command injection flaws, then executes arbitrary system commands with administrative privileges to compromise the system.
Prerequisites
- Network access to NetBox system on the configured port
- No valid credentials required (authentication bypass vulnerability)
Remotely exploitableNo authentication requiredLow complexity attackCritical CVSS score (9.8)Hardcoded credentials (CWE-259)Command injection (CWE-78)Affects access control systems
Exploitability
Moderate exploit probability (EPSS 1.1%)
Affected products (1)
ProductAffected VersionsFix Status
NetBox: <5.6.2<5.6.25.6.2
Remediation & Mitigation
0/5
Do now
0/2HARDENINGRestrict network access to NetBox system - ensure it is not reachable from the internet and is located behind a firewall
WORKAROUNDIf remote access is required, use VPN with current security updates
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpgrade NetBox to version 5.6.2 or later
Long-term hardening
0/2HARDENINGIsolate NetBox and access control network from the business network
HARDENINGReview and apply NetBox hardening guide recommendations from the built-in help menu
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/5dcc1d1a-c98d-47b9-81fc-35c123b03ecf