Incorrect Permission Assignment Local Privilege Escalation Vulnerability
CVE-2024-30369

7.8HIGH

Key Information:

Vendor

A10

Status
Thunder Adc
Vendor
CVE Published:
6 June 2024

What is CVE-2024-30369?

A vulnerability in the A10 Thunder ADC can be exploited by local attackers to escalate their privileges. This flaw lies in the installer, where incorrect file permissions permit an attacker, who has previously executed low-privileged code on the system, to escalate privileges and gain the ability to execute arbitrary code as the root user. This vulnerability highlights the need for stringent permission management in software installations to protect against unauthorized access.

Affected Version(s)

Thunder ADC 6.0.2, build 68

References

https://www.zerodayinitiative.com/advisories/ZDI-24-525/
x_research-advisory
https://support.a10networks.com/support/security_advisory...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.