A10 SDP-UP Pre-Auth RCE (CVE-2020-7865) and DoS (CVE-2020-7864) Analysis with POC

A10v2 SDP-UP Vulnerabilities Summary Vulnerability Overview This page discloses two critical vulnerabilities related to A10 Networks SDP-UP (Secure Data Plane - User Plane): CVE-2020-7864: Allows unauthenticated attackers to trigger device memory exhaustion or crash by crafting malicious HTTP requests, leading to a Denial of Service (DoS). CVE-2020-7865: Allows unauthenticated attackers to bypass access controls and execute arbitrary commands (Remote Code Execution, RCE) by sending specially crafted HTTP requests. Both vulnerabilities affect A10 SDP-UP devices and can be exploited without authentication. Scope of Impact Affected Products: A10 Networks SDP-UP devices (specific models not listed, but applicable to user plane components running relevant firmware versions). Affected Versions: - CVE-2020-7864: Affects all unpatched SDP-UP versions. - CVE-2020-7865: Affects all unpatched SDP-UP versions. Attack Vector: Remote, no authentication required, via HTTP protocol. CVSS Scores: - CVE-2020-7864: 7.5 (High) - CVE-2020-7865: 9.8 (Critical) Remediation Official Patch: A10 Networks has released a security update; users are advised to immediately upgrade to the latest stable version. Temporary Mitigation Measures: - Restrict access to the SDP-UP management interface (default ports 80/443) at the firewall or WAF level. - Disable unnecessary HTTP services or interfaces. - Monitor for anomalous traffic and system logs to detect attack attempts promptly. --- POC / Exploit Code CVE-2020-7864 (DoS) POC CVE-2020-7865 (RCE) POC > ⚠️ Note: The above code is for demonstration purposes only. Do not use it for illegal activities. Actual exploitation requires adjustment based on the specific environment of the target device. --- Additional Information Disclosure Date: October 2020 Source: A10 Networks Official Security Advisory Related Resources: - A10 Security Advisories - NVD CVE-2020-7864 - NVD CVE-2020-7865 Administrators are advised to assess and patch affected devices as soon as possible to prevent exploitation by attackers.

Goal Reached Thanks to every supporter — we hit 100%!

A10 SDP-UP Pre-Auth RCE (CVE-2020-7865) and DoS (CVE-2020-7864) Analysis with POC

More from this source