CVE-2024-3457

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/config_ISCGroupNoCache.php. The manipulation of the argument GroupId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259713 was assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Netentsec	NS-ASG Application Security Gateway	6.3
netentsec	ns-asg_application_security_gateway	6.3

References

https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-nconfig_ISCGroupNoCache.mdExploit
https://vuldb.com/?ctiid.259713Permissions Required, VDB Entry
https://vuldb.com/?id.259713Permissions Required, VDB Entry
https://vuldb.com/?submit.312184Third Party Advisory
https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-nconfig_ISCGroupNoCache.mdExploit
https://vuldb.com/?ctiid.259713Permissions Required, VDB Entry
https://vuldb.com/?id.259713Permissions Required, VDB Entry
https://vuldb.com/?submit.312184Third Party Advisory

Timeline

Published: Apr 8, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-345704.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons allows Stor CVE-2024-345716.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS CVE-2024-345726.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePrix Fancy Elementor Flipbox fanc CVE-2024-345736.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pootlepress Pootle Pagebuilder – WordP CVE-2024-345745.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpsoul Table Maker allows Stored XSS.T CVE-2024-345755.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in deTheme DethemeKit For Elemento CVE-2024-345776.1Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B and WRC-X3000GST2-B due to improper processing CVE-2024-345797.8Fuji Electric Alpha5 SMART is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.CVE-2024-34589.8A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown co CVE-2024-345805.3Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection agai CVE-2024-345817.3The W3C XML Signature Syntax and Processing (XMLDsig) specification, starting with 1.0, was originally published with a "RetrievalMethod is CVE-2024-345826.1Sunhillo SureLine through 8.10.0 on RICI 5000 devices allows cgi/usrPasswd.cgi userid_change XSS within the Forgot Password feature.