CVE-2024-2647 is a SQL injection in the Netentsec NS-ASG Application Security Gateway 6.3, in /admin/singlelogin.php through the loginId argument, scored High at 7.3. Severity is High at 7.3. No fix is named, and the record says the vendor did not respond to the disclosure.
What's affected
- Netentsec NS-ASG Application Security Gateway 6.3 is listed.
- The affected file is /admin/singlelogin.php and the argument is loginId.
- The record states that the vendor was contacted early and did not respond in any way, and that the exploit has been disclosed to the public.
- No fixed version is named in the NVD record. Check the vendor or the advisory linked in Sources before assuming a patch exists.
The NVD record gives a CVSS score of 7.3 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Published 2024-03-19.
How to check if you're exposed
- Check the appliance's management page for the product and firmware version.
- Review where the management and VPN web interfaces are reachable from. A security gateway's admin pages should not face the internet.
- Review web logs on the appliance, if available, for requests to singlelogin.php.
- See VulDB entry VDB-257285 and the public write up listed in the record.
What to do now
- Identify any NS-ASG 6.3 appliances in your environment.
- Restrict access to the management and web interfaces to a trusted administrative network.
- Contact the vendor or your supplier for a patched firmware and apply it when it is confirmed.
- Plan a replacement if no fix arrives, since an unmaintained gateway is a long term risk.
- Review logs and rotate administrator credentials if you see signs of abuse.
If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.
Why it matters
SQL injection arises when a request value is passed into a database query without being kept separate from it. On a gateway appliance the database often holds configuration, accounts and session information. The vector in the record shows network access with no privileges required and limited impact on each area. The vendor not responding matters, because without a patch the practical defence is network exposure control.
The record tags the weakness as CWE-89. See the Gold pages for more on the class.
SQL injection happens when input from a request is placed into a database query without being kept separate from the query itself. The database then treats part of the input as instructions. The usual defence is parameterised queries, plus a database account that can only do what the application needs.
The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.
Four SQL injection flaws in the same product version were published together: CVE-2024-2644, CVE-2024-2646, CVE-2024-2647 and CVE-2024-2649. Each affects a different file.
Quick check
Is there a vendor patch?
None is named. The record says the vendor did not respond to the disclosure, so assume no patch until the vendor says otherwise.
Sources
I did not retrieve the pages above when preparing this post, either because they blocked automated access or because I relied on the NVD record. The details here come from that record, so read the linked reference for the original wording.
Last reviewed: 19 October 2026.
