---
cve: "CVE-2025-32440"
severity: "CRITICAL"
cvss: 10.0
epss: "0.6%"
vendor: "jokob-sk"
kev: false
exploited: false
published: "2025-05-27 22:15:21"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T15:01:14+01:00"
---

# CVE-2025-32440

> 10.0 CRITICAL · 🧪 PoC

## Beschreibung

NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAlertX to update settings without authentication. An attacker can trigger sensitive functions within util.php by sending crafted requests to /index.php. This issue has been patched in version 25.4.14.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2025-05-28 13:45:52
- CNA-CVSS: **10.0** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-306** — Missing Authentication for Critical Functionality
  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

## Angriffsmuster (CAPEC)

- [CAPEC-12 — Choosing Message Identifier](https://capec.mitre.org/data/definitions/12.html) _(Severity: High)_
- [CAPEC-36 — Using Unpublished Interfaces or Functionality](https://capec.mitre.org/data/definitions/36.html) _(Severity: High)_
- [CAPEC-62 — Cross Site Request Forgery](https://capec.mitre.org/data/definitions/62.html) _(Severity: Very High)_
- [CAPEC-166 — Force the System to Reset Values](https://capec.mitre.org/data/definitions/166.html) _(Severity: Medium)_
- [CAPEC-216 — Communication Channel Manipulation](https://capec.mitre.org/data/definitions/216.html)

## Patch verfügbar (OSV)

- 4bb87fe8dfc51f9cf9c4cd236dc8f70935a6d4db (Commit)

## Referenzen

- <https://github.com/jokob-sk/NetAlertX/security/advisories/GHSA-h4x5-vr54-vjrx>
- <https://github.com/jokob-sk/NetAlertX/releases/tag/v25.4.14>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-32440/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_