PT-2023-6114 · A10 · A10 Thunder Adc

Chudypb + 1 · Published 2023-10-04 · Updated 2025-08-18 · CVE-2023-42130

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions A10 Thunder ADC (affected versions not specified)

Description The issue is related to the FileMgmtExport class in the Advanced Core Operating System (ACOS) of A10 Thunder ADC controllers, where there is improper restriction of a directory path with limited access. This allows a remote attacker to read and delete arbitrary files. The vulnerability can be exploited by remote attackers who have authentication, and it results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to read and delete files in the context of the service account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-06820

CVE-2023-42130

ZDI-23-1496

Affected Products

A10 Thunder Adc

References · 10

• https://zerodayinitiative.com/advisories/ZDI-23-1496 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-42130 · Security Note
• https://bdu.fstec.ru/vul/2023-06820 · Security Note
• https://support.a10networks.com/support/security_advisory/a10-acos-file-access-vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42130 · Vendor Advisory
• https://twitter.com/CVEnew/status/1786770989281427828 · Twitter Post
• https://vuldb.com/ru/?id.241369 · Note
• https://zerodayinitiative.com/advisories/ZDI-CAN-17905 · Note
• https://t.me/cveNotify/132672 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023100513 · Note