CVE-2024-2329 is a medium severity SQL injection in Netentsec NS-ASG Application Security Gateway 6.3, scored 6.3 by NVD. The record lists no fixed release, so there is no confirmed patch to install. Restrict access to the affected component, correct the code if you own it, or retire the software.
Weakness: CWE-89 (SQL Injection).
What's affected
- Affected: Netentsec NS-ASG Application Security Gateway, 6.3, as listed in the NVD record.
- Fixed: none named. The record names no fixed release for Netentsec NS-ASG Application Security Gateway. Treat the software as unpatched until the vendor or the project says otherwise.
- Attack conditions: the CVSS vector is
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means network reachable, a low-privilege account needed, and the attack needs no user interaction.
The record says the flaw sits in the file /admin/list_resource_icon.php?action=delete, through the argument IconId. The vendor was contacted early about this disclosure but did not respond in any way, according to the record. The record also says the exploit has been disclosed to the public, which is why the exposure window matters whatever the score.
How to check if you're exposed
This is a standalone application, not a package on a registry, so there is no package manager command that reports it. Work through these steps instead.
- Search your hosting inventory, source repositories and deployment folders for the project name (Netentsec NS-ASG Application Security Gateway).
- Open the installed copy and confirm whether it is version 6.3. If the version is not recorded, assume it is affected.
- Check whether /admin/list_resource_icon.php?action=delete can be reached from outside your network and who can authenticate to it.
- Review web server access logs for unexpected requests to that path, and keep the logs you find.
If you track dependencies, the free in-browser dependency scan can show whether a library or package in your project matches a known CVE. It will not find a standalone PHP application or a firmware image that was never packaged as a dependency, so keep your own inventory of those.
What to do now
- Find every deployment of Netentsec NS-ASG Application Security Gateway and decide whether it needs to be online at all. Many of these projects are tutorial or demo code.
- Look for a vendor or upstream update. The record names none, so check the project repository and the VulDB entry linked in the sources.
- Put the application behind authentication and a network allow list, or take it offline, until a fix exists.
- If you own the code, replace string built queries with parameterized queries or prepared statements, and give the database account only the rights it needs.
- Record the exception in your risk register with an owner and a review date.
Why it matters
SQL injection happens when user input is placed into a query string instead of being passed as a parameter. The database cannot tell the developer's SQL from the visitor's text, so crafted input can change what the query does. The usual cure is a parameterized query, which keeps the two apart.
The record classes this as CWE-89 (SQL Injection). NVD scored it 6.3 (Medium) with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The KEV flag in the record is false, so CISA's Known Exploited Vulnerabilities catalog does not list it, though the record notes public disclosure of the exploit. Small open source and sample style applications like this one often never get patched, so the control you have is exposure, not a version bump.
Quick check
Is there a patch for CVE-2024-2329?
The record lists no fixed version for Netentsec NS-ASG Application Security Gateway. Check the project repository and the VulDB entry before assuming one exists, and plan around restricting access in the meantime.
Is this being exploited in the wild?
The record's KEV flag is false and no advisory we reviewed reports exploitation. The record does say the exploit details were published, so a copy of the technique is available to anyone.
Sources
- CVE-2024-2329 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2329, as held in the batch record
- VulDB entry for this CVE, linked from the record (see the Gold page for the reference list)
Last reviewed: 19 October 2026.
