7.8

CVE-2024-30369

A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability

A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of A10 Thunder ADC. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the installer. The issue results from incorrect permissions on a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-22754.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update -
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p1
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p10
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p11
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p12
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p13
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p2
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p3
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p4
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p5
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p6
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p7
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p8
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update gr1-p9
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update p1
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update p2
A10networks ≫ Advanced Core Operating System Version 4.1.4 Update p3
A10networks ≫ Advanced Core Operating System Version 5.1.0 Update -
A10networks ≫ Advanced Core Operating System Version 5.1.0 Update p3
A10networks ≫ Advanced Core Operating System Version 5.1.0 Update p4
A10networks ≫ Advanced Core Operating System Version 5.1.0 Update p5
A10networks ≫ Advanced Core Operating System Version 5.1.0 Update p6
A10networks ≫ Advanced Core Operating System Version 5.2.0 Update -
A10networks ≫ Advanced Core Operating System Version 5.2.0 Update p1
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update -
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p1
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p2
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p3
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p4
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p5
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p6
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p7
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p8
A10networks ≫ Advanced Core Operating System Version 5.2.1 Update p9
A10networks ≫ Advanced Core Operating System Version 6.0.0 Update -
A10networks ≫ Advanced Core Operating System Version 6.0.0 Update p1
A10networks ≫ Advanced Core Operating System Version 6.0.0 Update p2
A10networks ≫ Advanced Core Operating System Version 6.0.0 Update p2-sp1
A10networks ≫ Advanced Core Operating System Version 6.0.2 Update -
A10networks ≫ Advanced Core Operating System Version 6.0.2 Update p1
A10networks ≫ Advanced Core Operating System Version 6.0.3 Update -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.174
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Trend Micro 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

https://support.a10networks.com/support/security_advisory/cve-2024-30368-cve-2024-30369
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-525/
Third Party Advisory
VDB Entry