CVE-2020-24640

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

There is a vulnerability caused by insufficient input validation that allows for arbitrary command execution in a containerized environment within Airwave Glass before 1.3.3. Successful exploitation can lead to complete compromise of the underlying host operating system.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	Aruba AirWave Glass Software	Prior to 1.3.3

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-001.txtVendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-001.txtVendor Advisory

Timeline

Published: Jan 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-246417.5In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if succes CVE-2020-246469.8A tftpserver stack-based buffer overflow remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) versi CVE-2020-246479.8A remote accessmgrservlet classname input validation code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) CVE-2020-246489.8A accessmgrservlet classname deserialization of untrusted data remote code execution vulnerability was discovered in HPE Intelligent Managem CVE-2020-246499.8A remote bytemessageresource transformentity" input validation code execution vulnerability was discovered in HPE Intelligent Management Cen CVE-2020-246509.8A legend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version CVE-2020-246519.8A syslogtempletselectwin expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Cent CVE-2020-246529.8A addvsiinterfaceinfo expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center CVE-2020-246539.8secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVIC CVE-2020-246543.3In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a writ CVE-2020-246555.1A race condition in the Twilio Authy 2-Factor Authentication application before 24.3.7 for Android allows a user to potentially approve/deny CVE-2020-246566.5Maltego before 4.2.12 allows XXE attacks.