CVE-2024-2422 Overview
CVE-2024-2422 is an authenticated remote code execution (RCE) vulnerability in Honeywell LenelS2 NetBox, an access control and event monitoring system used in physical security deployments. The flaw affects all versions up to and including 5.6.1 and is tracked under CWE-88: Improper Neutralization of Argument Delimiters in a Command. An authenticated attacker can submit crafted input that the application passes to a shell or command interpreter, resulting in arbitrary command execution on the NetBox host. CISA published an Industrial Control Systems advisory covering the issue, reflecting the operational technology exposure created by vulnerable access control appliances.
Critical Impact
An authenticated attacker can execute arbitrary commands on the NetBox controller, compromising physical access control, door operation, and event monitoring integrity.
Affected Products
- Honeywell LenelS2 NetBox versions up to and including 5.6.1
- LenelS2 NetBox access control system
- LenelS2 NetBox event monitoring system
Discovery Timeline
- 2024-05-30 - CVE-2024-2422 published to the National Vulnerability Database
- 2024-05-30 - CISA released ICS Advisory ICSA-24-151-01
- 2024 - Carrier issued Product Security Advisory CARR-PSA-2024-01
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-2422
Vulnerability Analysis
LenelS2 NetBox is a networked access control platform that manages doors, readers, and event telemetry across enterprise facilities. The vulnerability allows an authenticated user to inject argument delimiters into a parameter that the application forwards to an underlying system command. Because the application fails to neutralize these delimiters, attacker-supplied arguments are interpreted by the shell or process invocation layer as additional commands or options.
Successful exploitation grants the attacker code execution in the context of the NetBox service account. From that position, an attacker can manipulate access control decisions, disable logging, pivot into the operational network, or maintain persistence on the controller. The flaw is reachable over the network and requires no user interaction once valid credentials are obtained.
Root Cause
The root cause is improper neutralization of argument delimiters when constructing a command line from user-supplied data, classified as CWE-88. The application concatenates input into a command string without enforcing strict allowlists or using safe parameterized process APIs.
Attack Vector
Exploitation requires network access to the NetBox web interface and valid authenticated credentials. An attacker submits a request containing crafted argument delimiters in a vulnerable parameter, causing the server to execute attacker-controlled commands. Honeywell and Carrier advisories provide technical details under coordinated disclosure. See the Carrier PSA CARR-PSA-2024-01 for affected component identification.
Detection Methods for CVE-2024-2422
Indicators of Compromise
- Unexpected child processes spawned by the NetBox web service, including shells (sh, bash) or system utilities (curl, wget, nc).
- Outbound network connections from the NetBox host to unknown external IP addresses or non-standard ports.
- Modifications to NetBox configuration files, scheduled tasks, or service binaries outside of vendor-authorized maintenance windows.
- Authentication events followed shortly by anomalous administrative API requests containing shell metacharacters such as ;, |, &&, or backticks.
Detection Strategies
- Monitor HTTP request logs on the NetBox appliance for parameter values containing argument delimiters, command separators, or encoded shell characters.
- Correlate authenticated NetBox sessions with subsequent process creation events on the host to surface unauthorized command execution.
- Apply network detection signatures on traffic to NetBox management interfaces to flag suspicious POST payloads targeting known vulnerable endpoints.
Monitoring Recommendations
- Forward NetBox application logs, authentication logs, and host process telemetry to a centralized SIEM for retention and correlation.
- Alert on any new outbound connections originating from the NetBox controller, which should typically communicate only with defined badge readers and management hosts.
- Track configuration changes and firmware versions on NetBox appliances to confirm patch deployment status.
How to Mitigate CVE-2024-2422
Immediate Actions Required
- Identify all LenelS2 NetBox appliances and confirm firmware versions; treat any system at or below 5.6.1 as vulnerable.
- Apply the fixed firmware released by Honeywell and Carrier as documented in ICSA-24-151-01.
- Rotate administrative and operator credentials on NetBox systems following patch installation.
- Restrict management interface access to dedicated security VLANs reachable only by authorized administrators.
Patch Information
Honeywell has released updated NetBox firmware addressing CVE-2024-2422. Refer to Carrier Product Security Advisory CARR-PSA-2024-01 for the fixed version and upgrade procedure. Apply the update following vendor guidance and validate access control functionality post-upgrade.
Workarounds
- Place NetBox controllers behind a firewall and block all inbound traffic from untrusted networks, including the internet, in accordance with CISA ICS guidance.
- Enforce least-privilege accounts on NetBox so that compromise of a low-privilege user cannot reach the vulnerable functionality.
- Require multi-factor authentication for remote access pathways such as VPNs used to reach NetBox management interfaces.
- Enable detailed audit logging and forward logs off-box to preserve forensic evidence if the appliance is compromised.
# Example network restriction enforcing management-only access to NetBox
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
