Paper/Archive/CVE-2024-3458

CVE-2024-3458

Netentsec NS-ASG Application Security Gateway — Netentsec NS-ASG Application Security Gateway add_ikev2.php sql injection

EPSS 0.7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 53.4.534 × 2010.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /admin/add_ikev2.php. The manipulation of the argument TunnelId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259714 is the identifier assigned to this vulnerability.

Affected

ProductAffectedFixed inSource

NS-ASG Application Security Gateway6.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.259714 refvuldb.com/?ctiid.259714 writeupvuldb.com/?submit.312186 exploitgithub.com/hundanchen69/cve/blob/main/NS-ASG-sql-add_ikev2.md