CVE-2024-30368

Q: What is the severity of CVE-2024-30368?

CVE-2024-30368 has a CVSS score of 8.8 (HIGH). This vulnerability allows authenticated remote attackers to execute arbitrary system commands on A10 Thunder ADC devices. Attackers can achieve remote code execution with a10user privileges by exploiting improper input validation in the CsrRequestView class. Organizations using affected A10 Thunder ADC versions are at risk.

8.8 HIGH

Remote Code Execution

📋 TL;DR

This vulnerability allows authenticated remote attackers to execute arbitrary system commands on A10 Thunder ADC devices. Attackers can achieve remote code execution with a10user privileges by exploiting improper input validation in the CsrRequestView class. Organizations using affected A10 Thunder ADC versions are at risk.

💻 Affected Systems

Products:

A10 Thunder ADC

Versions: Specific versions not detailed in provided references; check vendor advisory for exact affected versions

Operating Systems: A10 ACOS-based systems

Default Config Vulnerable: ⚠️ Yes

Notes: Authentication is required to exploit this vulnerability, but default or weak credentials increase risk.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise allowing attackers to execute arbitrary code, pivot to other systems, steal sensitive data, or deploy ransomware.

🟠

Likely Case

Unauthorized command execution leading to data exfiltration, configuration changes, or installation of backdoors.

🟢

If Mitigated

Limited impact due to network segmentation, strong authentication controls, and monitoring preventing successful exploitation.

🌐 Internet-Facing: HIGH - ADC devices are typically internet-facing and handle critical traffic, making them attractive targets.

🏢 Internal Only: MEDIUM - Internal exploitation still possible but requires attacker to have network access and valid credentials.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authentication but the vulnerability itself is straightforward command injection.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check vendor advisory for specific patched versions

Vendor Advisory: https://support.a10networks.com/support/security_advisory/cve-2024-30368-cve-2024-30369

Restart Required: Yes

Instructions:

1. Review vendor advisory for affected versions. 2. Download and apply the latest firmware/software update from A10 support portal. 3. Reboot the ADC device after patching. 4. Verify the patch was successfully applied.

🔧 Temporary Workarounds

Restrict Administrative Access

all

Limit administrative interface access to trusted IP addresses only

Configure firewall rules to restrict access to ADC management interface

Enforce Strong Authentication

all

Implement multi-factor authentication and strong password policies for administrative accounts

Configure MFA on ADC administrative accounts
Enforce password complexity requirements

🧯 If You Can't Patch

Implement network segmentation to isolate ADC management interfaces
Enable detailed logging and monitoring for suspicious administrative activities

🔍 How to Verify

Check if Vulnerable:

Check current firmware version against vendor advisory for affected versions

Check Version:

show version (on A10 Thunder ADC CLI)

Verify Fix Applied:

Verify firmware version matches or exceeds patched version specified in vendor advisory

📡 Detection & Monitoring

Log Indicators:

Unusual administrative login attempts
Suspicious command execution in system logs
Multiple failed authentication attempts followed by successful login

Network Indicators:

Unusual traffic patterns to/from ADC management interface
Unexpected outbound connections from ADC

SIEM Query:

source="a10_adc" AND (event_type="authentication" AND result="success" FROM suspicious_ip) OR (process_execution="*cmd*" OR process_execution="*sh*")

📊 Metadata

CVE ID: CVE-2024-30368

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-78

Published: June 6, 2024

Last Updated: November 21, 2024

🔗 References

https://support.a10networks.com/support/security_advisory/cve-2024-30368-cve-2024-30369 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-524/ Third Party Advisory,VDB Entry
https://support.a10networks.com/support/security_advisory/cve-2024-30368-cve-2024-30369 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-524/ Third Party Advisory,VDB Entry

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

Advanced Core Operating System by A10networks

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Restrict Administrative Access

Enforce Strong Authentication

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities