PT-2020-15722 · A10 Networks · A10 Networks Acos+1

Frederic Ladouceur + 2 · Published 2020-11-10 · Updated 2020-11-24 · CVE-2020-24384

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions A10 Networks ACOS versions 3.2.x (including and after 3.2.2), 4.x, and 5.1.x aGalaxy versions 3.0.x, 3.2.x, and 5.0.x

Description A10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated Remote Code Execution (RCE) vulnerability that could be used to compromise affected ACOS systems.

Recommendations For A10 Networks ACOS versions 3.2.x (including and after 3.2.2), 4.x, and 5.1.x, update to a version that includes the fix for this issue. For aGalaxy versions 3.0.x, 3.2.x, and 5.0.x, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the management GUIs until a patch is available.

Fix

Related Identifiers

CVE-2020-24384

Affected Products

A10 Networks Acos

Galaxy

References · 5

• https://osv.dev/vulnerability/CVE-2020-24384 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24384 · Security Note
• https://support.a10networks.com/support/security_advisory/acos-agalaxy-gui-rce-vulnerability-cve-2020-24384 · Vendor Advisory
• https://t.me/cvenotify/6130 · Telegram Post
• https://t.me/cibsecurity/16080 · Telegram Post