CVE-2020-24638

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Multiple authenticated remote command executions are possible in Airwave Glass before 1.3.3 via the glassadmin cli. These allow for a user with glassadmin privileges to execute arbitrary code as root on the underlying host operating system.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	Aruba AirWave Glass Software	Prior to 1.3.3

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-001.txtVendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-001.txtVendor Advisory

Timeline

Published: Jan 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-246399.8There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a containerized environment wi CVE-2020-246409.8There is a vulnerability caused by insufficient input validation that allows for arbitrary command execution in a containerized environment CVE-2020-246417.5In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if succes CVE-2020-246469.8A tftpserver stack-based buffer overflow remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) versi CVE-2020-246479.8A remote accessmgrservlet classname input validation code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) CVE-2020-246489.8A accessmgrservlet classname deserialization of untrusted data remote code execution vulnerability was discovered in HPE Intelligent Managem CVE-2020-246499.8A remote bytemessageresource transformentity" input validation code execution vulnerability was discovered in HPE Intelligent Management Cen CVE-2020-246509.8A legend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version CVE-2020-246519.8A syslogtempletselectwin expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Cent CVE-2020-246529.8A addvsiinterfaceinfo expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center CVE-2020-246539.8secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVIC CVE-2020-246543.3In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a writ