A10networks

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any A10networks product.

RSS Feeds for A10networks security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in A10networks products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by A10networks Sorted by Most Security Vulnerabilities since 2018

A10networks Advanced Core Operating System6 vulnerabilities

A10networks Acos Web Application Firewall1 vulnerability

A10networks Agalaxy1 vulnerability

By the Year

In 2025 there have been 0 vulnerabilities in A10networks. Last year, in 2024 A10networks had 4 security vulnerabilities published. Right now, A10networks is on track to have less security vulnerabilities in 2025 than it did last year.

Year	Vulnerabilities	Average Score
2025	0	0.00
2024	4	8.47
2023	0	0.00
2022	0	0.00
2021	0	0.00
2020	1	9.80
2019	0	0.00
2018	2	8.65

It may take a day or so for new A10networks vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent A10networks Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2024-30369	Jun 06, 2024	A10 Thunder ADC Local Privilege Escalation via Installer Permission Misset A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of A10 Thunder ADC. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the installer. The issue results from incorrect permissions on a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-22754.	Advanced Core Operating System
CVE-2024-30368	Jun 06, 2024	CsrRequestView Command Injection RCE in A10 Thunder ADC A10 Thunder ADC CsrRequestView Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of A10 Thunder ADC. Authentication is required to exploit this vulnerability. The specific flaw exists within the CsrRequestView class. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of a10user. Was ZDI-CAN-22517.	Advanced Core Operating System
CVE-2023-42130	May 03, 2024	A10 Thunder ADC Directory Traversal for File Read/Del A10 Thunder ADC FileMgmtExport Directory Traversal Arbitrary File Read and Deletion Vulnerability. This vulnerability allows remote attackers to read and delete arbitrary files on affected installations of A10 Thunder ADC. Authentication is required to exploit this vulnerability. The specific flaw exists within the FileMgmtExport class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to read and delete files in the context of the service account. . Was ZDI-CAN-17905.	Advanced Core Operating System
CVE-2023-42129	May 03, 2024	ShowTechDownloadView Directory Traversal in A10 ADC A10 Thunder ADC ShowTechDownloadView Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of A10 Thunder ADC. Authentication is required to exploit this vulnerability. The specific flaw exists within the ShowTechDownloadView class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. . Was ZDI-CAN-17899.	Advanced Core Operating System
CVE-2020-24384	Nov 10, 2020	A10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated Remote Code Execution (RCE) vulnerability A10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated Remote Code Execution (RCE) vulnerability that could be used to compromise affected ACOS systems. ACOS versions 3.2.x (including and after 3.2.2), 4.x, and 5.1.x are affected. aGalaxy versions 3.0.x, 3.2.x, and 5.0.x are affected.	Agalaxy Advanced Core Operating System
CVE-2018-15904	Aug 27, 2018	A10 ACOS Web Application Firewall (WAF) 2.7.1 and 2.7.2 before 2.7.2-P12 A10 ACOS Web Application Firewall (WAF) 2.7.1 and 2.7.2 before 2.7.2-P12, 4.1.0 before 4.1.0-P11, 4.1.1 before 4.1.1-P8, and 4.1.2 before 4.1.2-P4 mishandles the configured rules for blocking SQL injection attacks, aka A10-2017-0008.	Acos Web Application Firewall
CVE-2018-5390	Aug 06, 2018	Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.	Advanced Core Operating System