Netentsec · Netentsec Ns-Asg Application Security Gateway · CVE-2024-6007
Name of the Vulnerable Software and Affected Versions:
Netentsec NS-ASG Application Security Gateway version 6.3
Description:
A critical issue has been found in the Netentsec NS-ASG Application Security Gateway. This issue affects the file /protocol/iscgwtunnel/deleteiscgwrouteconf.php and allows for SQL injection through the manipulation of the `messagecontent` argument. The attack can be initiated remotely. The exploit has been disclosed publicly.
Recommendations:
For version 6.3, as a temporary workaround, consider restricting access to the `/protocol/iscgwtunnel/deleteiscgwrouteconf.php` file until a patch is available. Avoid using the `messagecontent` argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.