CVE-2025-32440

Published: May 27, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAlertX to update settings without authentication. An attacker can trigger sensitive functions within util.php by sending crafted requests to /index.php. This issue has been patched in version 25.4.14.

Affected (1)

Products: Netalertx: Netalertx

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Netalertx Netalertx	Before 25.4.14

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (3)

https://github.com/jokob-sk/NetAlertX/releases/tag/v25.4.14

Source: security-advisories@github.com

Release Notes

https://github.com/jokob-sk/NetAlertX/security/advisories/GHSA-h4x5-vr54-vjrx

Source: security-advisories@github.com

Vendor Advisory

https://github.com/jokob-sk/NetAlertX/security/advisories/GHSA-h4x5-vr54-vjrx

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Vendor Advisory

Timeline

No history available yet.