PT-2021-11050 · Unknown · Airwave Glass

Published 2021-01-15 · Updated 2021-01-21 · CVE-2020-24638

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Airwave Glass versions prior to 1.3.3

Description: Multiple authenticated remote command executions are possible via the glassadmin cli, allowing a user with glassadmin privileges to execute arbitrary code as root on the underlying host operating system.

Recommendations: For versions prior to 1.3.3, update to version 1.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the glassadmin cli to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2020-24638

Affected Products

Airwave Glass

References · 5

• https://arubanetworks.com/assets/alert/ARUBA-PSA-2021-001.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24638 · Security Note
• https://t.me/cvenotify/8837 · Telegram Post
• https://t.me/cibsecurity/22223 · Telegram Post