CVE-2024-3458

A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /admin/add_ikev2.php. The manipulation of the argument TunnelId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259714 is the identifier assigned to this vulnerability.

• CWE-89

• https://github.com/hundanchen69/cve/blob/main/NS-ASG-sql-add_ikev2.mdExploit
• https://vuldb.com/?ctiid.259714Permissions Required, VDB Entry
• https://vuldb.com/?id.259714Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.312186Third Party Advisory
• https://github.com/hundanchen69/cve/blob/main/NS-ASG-sql-add_ikev2.mdExploit
• https://vuldb.com/?ctiid.259714Permissions Required, VDB Entry
• https://vuldb.com/?id.259714Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.312186Third Party Advisory

Published

Apr 8, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34572Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2024-34573Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2024-34574Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2024-34575Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2024-34577Cross-site scripting vulnerability exists in WRC-X3000GS2-B,…6.1
• CVE-2024-34579Fuji Electric Alpha5 SMART is vulnerable to a stack-based …8.5
• CVE-2024-34580Apache XML Security for C++ through 2.0.4 implements the XML…5.3
• CVE-2024-34581The W3C XML Signature Syntax and Processing (XMLDsig) specif…7.3
• CVE-2024-34582Sunhillo SureLine through 8.10.0 on RICI 5000 devices allows…6.1
• CVE-2024-34583Improper access control in system property prior to SMR Jul-…3.3
• CVE-2024-34584Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. Re…
• CVE-2024-34585Improper access control in launchApp of SystemUI prior to SM…7.8