CVE-2024-2330
Published: 09 March 2024
Summary
CVE-2024-2330 is a medium-severity SQL Injection (CWE-89) vulnerability in Netentsec Application Security Gateway. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-2330 is a SQL injection vulnerability affecting the Netentsec NS-ASG Application Security Gateway version 6.3. The flaw resides in an unspecified component of the file /protocol/index.php, where unsanitized input to the IPAddr parameter allows malicious SQL statements to be executed.
The issue can be triggered remotely by an authenticated attacker with low-privileged credentials. Successful exploitation yields limited read, write, and disruption capabilities against the underlying database, as reflected in the CVSS 6.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Public proof-of-concept code has been released, enabling straightforward reproduction.
Vendor advisories and patches are unavailable; the product maintainer was notified prior to disclosure but provided no response. The referenced technical write-ups and Vuldb entries contain only the original researcher’s reproduction steps and do not list work-arounds or fixed firmware versions.
EPSS currently stands at 0.9275 with a recorded peak of 0.9306, indicating sustained and elevated exploitation interest since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27284
Vulnerability details
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /protocol/index.php. The manipulation of the argument IPAddr leads to sql injection. It is possible to…
more
initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256281 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.