CVE-2024-30865

The vulnerability results from the lack of proper validation and sanitization of input data passed to the /admin/edit_user_login.php endpoint. An attacker can inject malicious SQL code fragments in HTTP request parameters, which are then executed by the database engine without proper sanitization. The attack does not require authentication or user interaction, and its vector is network-based, making it particularly dangerous.

An attacker can gain unauthorized access to sensitive data stored in the database, modify or delete data, and under favorable circumstances take full control of the system.

Patches available from the manufacturer should be applied in accordance with the references. It is also recommended to restrict access to the admin panel exclusively to trusted IP addresses and to monitor network traffic for unusual HTTP requests directed at administrative endpoints.

Netentsec NS-ASG Firmware and Netentsec NS-ASG version 6.3