PT-2021-11051 · Unknown · Airwave Glass

Published 2021-01-15 · Updated 2021-01-21 · CVE-2020-24639

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Airwave Glass versions prior to 1.3.3

Description: The issue is caused by unsafe Java deserialization, allowing for arbitrary command execution in a containerized environment. This can lead to the complete compromise of the underlying host operating system.

Recommendations: For versions prior to 1.3.3, update to version 1.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the containerized environment to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-24639

Affected Products

Airwave Glass

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-24639 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24639 · Vendor Advisory
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2021-001.txt · Vendor Advisory
• https://t.me/cibsecurity/22221 · Telegram Post
• https://t.me/cvenotify/8833 · Telegram Post
• https://t.me/cvenotify/8608 · Telegram Post