CVE-2024-30369
HIGHA10networks Advanced Core Operating S... - Incorrect Permission Assignment
Title source: ruleDescription
A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of A10 Thunder ADC. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the installer. The issue results from incorrect permissions on a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-22754.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry x_research-advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-525/
Vendor Advisory vendor-advisory
https://support.a10networks.com/support/security_advisory/cve-2024-30368-cve-2024-30369
Scores
CVSS v3
7.8
EPSS
0.0005
EPSS Percentile
14.1%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-732
Status
published
Products (8)
a10networks/advanced_core_operating_system
4.1.4 (18 CPE variants)
a10networks/advanced_core_operating_system
5.1.0 (5 CPE variants)
a10networks/advanced_core_operating_system
5.2.0 (2 CPE variants)
a10networks/advanced_core_operating_system
5.2.1 (10 CPE variants)
a10networks/advanced_core_operating_system
6.0.0 (4 CPE variants)
a10networks/advanced_core_operating_system
6.0.1
a10networks/advanced_core_operating_system
6.0.2 (2 CPE variants)
a10networks/advanced_core_operating_system
6.0.3
Published
Jun 06, 2024
Tracked Since
Feb 18, 2026