NetAlertX Vulnerable to Authentication Bypass
Priority HIGH 82CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAlertX to update settings without authentication. An attacker can trigger sensitive functions within util.php by sending crafted requests to /index.php. This issue has been patched in version 25.4.14.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00604 49th percentileScored 2026-11-07
Fix Fixed NetAlertX (jokob-sk): 25.4.14
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jokob-sk | NetAlertX | before 25.4.14 | 25.4.14 | Patch available | CNA |
- NetAlertX Vendorjokob-sk Affected before 25.4.14 Fixed in 25.4.14 Patch available CNA
Remediation
- Fix · CNA NetAlertX (jokob-sk) Fixed in 25.4.14
Timeline
- 2026-10-02 Threatist record created from CVE-2025-32440
References
More Netalertx vulnerabilities
- TI-2024-31001 Missing authentication in NetAlertX CVSS 3.1CRITICAL 10.0
- TI-2025-31090 NetAlertX has Password Bypass Vulnerability due to Loose Comparison in PHP CVSS 3.1CRITICAL 9.4
- TI-2024-32490 Path traversal in NetAlertX CVSS 3.1HIGH 8.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences