Vulnerability · Published May 27, 2025 · Assigned by GitHub_M

CVE-2025-32440NetAlertX Vulnerable to Authentication Bypass

Critical 10.0

In plain English

A critical-severity missing authentication in NetAlertX from jokob-sk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.6%top 50.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAlertX to update settings without authentication. An attacker can trigger sensitive functions within util.php by sending crafted requests to /index.php. This issue has been patched in version 25.4.14.

Affected products (as reported)

Vendor	Product	Versions
jokob-sk	NetAlertX	< 25.4.14

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/jokob-sk/NetAlertX/security/advisories/GHSA-h4x5-vr54-vjrx x_refsource_CONFIRM
https://github.com/jokob-sk/NetAlertX/releases/tag/v25.4.14 x_refsource_MISC