CVE-2020-24384

published 2020-11-10

CVE-2020-24384: A10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated Remote Code Execution (RCE) vulnerability that could be used…

Priority P2 69 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated Remote Code Execution (RCE) vulnerability that could be used to compromise affected ACOS systems. ACOS versions 3.2.x (including and after 3.2.2), 4.x, and 5.1.x are affected. aGalaxy versions 3.0.x, 3.2.x, and 5.0.x are affected.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
a10networks	advanced_core_operating_system	—	—
a10networks	advanced_core_operating_system	—	—
a10networks	advanced_core_operating_system	—	—
a10networks	advanced_core_operating_system	—	—
a10networks	advanced_core_operating_system	—	—
a10networks	advanced_core_operating_system	—	—
a10networks	advanced_core_operating_system	—	—
a10networks	advanced_core_operating_system	—	—
a10networks	advanced_core_operating_system	—	—
a10networks	advanced_core_operating_system	—	—
a10networks	advanced_core_operating_system	—	—
a10networks	advanced_core_operating_system	—	—
a10networks	agalaxy	—	—
a10networks	agalaxy	—	—
a10networks	agalaxy	—	—
a10networks	agalaxy	3.2.1 – 3.2.4	—
a10networks	agalaxy	>= 5.0.1 < 5.0.5	5.0.5

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.