CVE-2025-32440: NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAl...

Description

NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAlertX to update settings without authentication. An attacker can trigger sensitive functions within util.php by sending crafted requests to /index.php. This issue has been patched in version 25.4.14.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.53%

40.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-306

Affected Software

Vendor	Product	Versions
Netalertx	Netalertx	< 25.4.14

References

https://github.com/jokob-sk/NetAlertX/releases/tag/v25.4.14Release Notes
https://github.com/jokob-sk/NetAlertX/security/advisories/GHSA-h4x5-vr54-vjrxVendor Advisory
https://github.com/jokob-sk/NetAlertX/security/advisories/GHSA-h4x5-vr54-vjrxVendor Advisory

Timeline

Published: May 27, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-32440?

NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAlertX to update settings without authentication. An attacker can trigger sensitive functions within util.php by sending crafted requests to /index.php. This issue has been patched in version 25.4.14.

How severe is CVE-2025-32440?

CVE-2025-32440 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.53% probability of exploitation in the next 30 days.

How do I fix CVE-2025-32440?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →