8.8

CVE-2024-30368

A10 Thunder ADC CsrRequestView Command Injection Remote Code Execution Vulnerability

A10 Thunder ADC CsrRequestView Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of A10 Thunder ADC. Authentication is required to exploit this vulnerability.

The specific flaw exists within the CsrRequestView class. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of a10user. Was ZDI-CAN-22517.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update -
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p1
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p10
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p11
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p12
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p13
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p2
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p3
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p4
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p5
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p6
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p7
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p8
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p9
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update p1
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update p2
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update p3
A10networks ≫ Advanced Core Operating System Version 5.1.0 Update -
A10networks ≫ Advanced Core Operating System Version 5.1.0 Update p3
A10networks ≫ Advanced Core Operating System Version 5.1.0 Update p4
A10networks ≫ Advanced Core Operating System Version 5.1.0 Update p5
A10networks ≫ Advanced Core Operating System Version 5.1.0 Update p6
A10networks ≫ Advanced Core Operating System Version 5.2.0 Update -
A10networks ≫ Advanced Core Operating System Version 5.2.0 Update p1
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update -
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p1
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p2
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p3
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p4
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p5
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p6
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p7
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p8
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p9
A10networks ≫ Advanced Core Operating System Version 6.0.0 Update -
A10networks ≫ Advanced Core Operating System Version 6.0.0 Update p1
A10networks ≫ Advanced Core Operating System Version 6.0.0 Update p2
A10networks ≫ Advanced Core Operating System Version 6.0.0 Update p2-sp1
A10networks ≫ Advanced Core Operating System Version 6.0.2 Update -
A10networks ≫ Advanced Core Operating System Version 6.0.2 Update p1
A10networks ≫ Advanced Core Operating System Version 6.0.3 Update -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.02% 0.857
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Trend Micro 7.2 1.2 5.9
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://support.a10networks.com/support/security_advisory/cve-2024-30368-cve-2024-30369
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-524/
Third Party Advisory
VDB Entry