Read the docs
TI-2018-11341 Aliases CVE-2018-15904GHSA-xmhq-c3vw-6j9m

A10 ACOS Web Application Firewall (WAF) 2.7.1 and 2.7.2 before 2.7.2-P12, 4.1.0 before…

Priority MEDIUM 44CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

A10 ACOS Web Application Firewall (WAF) 2.7.1 and 2.7.2 before 2.7.2-P12, 4.1.0 before 4.1.0-P11, 4.1.1 before 4.1.1-P8, and 4.1.2 before 4.1.2-P4 mishandles the configured rules for blocking SQL injection attacks, aka A10-2017-0008.

Why it matters now

EPSS 0.0106 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 37

CPEVersionsRoleVendor
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:*:*:*:*:*:*:*2.7.2VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p1:*:*:*:*:*:*2.7.2 p1VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p10:*:*:*:*:*:*2.7.2 p10VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p11:*:*:*:*:*:*2.7.2 p11VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p2:*:*:*:*:*:*2.7.2 p2VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p3:*:*:*:*:*:*2.7.2 p3VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p4:*:*:*:*:*:*2.7.2 p4VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p5:*:*:*:*:*:*2.7.2 p5VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p6:*:*:*:*:*:*2.7.2 p6VulnerableA10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p1:*:*:*:*:*:* Versions 2.7.2 p1 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p10:*:*:*:*:*:* Versions 2.7.2 p10 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p11:*:*:*:*:*:* Versions 2.7.2 p11 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p2:*:*:*:*:*:* Versions 2.7.2 p2 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p3:*:*:*:*:*:* Versions 2.7.2 p3 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p4:*:*:*:*:*:* Versions 2.7.2 p4 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p5:*:*:*:*:*:* Versions 2.7.2 p5 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p6:*:*:*:*:*:* Versions 2.7.2 p6 Vulnerable ·A10
Show 27 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p7:*:*:*:*:*:*2.7.2 p7VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p7-sp3:*:*:*:*:*:*2.7.2 p7-sp3VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p8:*:*:*:*:*:*2.7.2 p8VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p9:*:*:*:*:*:*2.7.2 p9VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p1:*:*:*:*:*:*4.1.0 p1VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p10:*:*:*:*:*:*4.1.0 p10VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p2:*:*:*:*:*:*4.1.0 p2VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p3:*:*:*:*:*:*4.1.0 p3VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p4:*:*:*:*:*:*4.1.0 p4VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p5:*:*:*:*:*:*4.1.0 p5VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p6:*:*:*:*:*:*4.1.0 p6VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p7:*:*:*:*:*:*4.1.0 p7VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p8:*:*:*:*:*:*4.1.0 p8VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p9:*:*:*:*:*:*4.1.0 p9VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p1:*:*:*:*:*:*4.1.1 p1VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p2:*:*:*:*:*:*4.1.1 p2VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p3:*:*:*:*:*:*4.1.1 p3VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p4:*:*:*:*:*:*4.1.1 p4VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p5:*:*:*:*:*:*4.1.1 p5VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p6:*:*:*:*:*:*4.1.1 p6VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p7:*:*:*:*:*:*4.1.1 p7VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.2:*:*:*:*:*:*:*4.1.2VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.2:p1:*:*:*:*:*:*4.1.2 p1VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.2:p2:*:*:*:*:*:*4.1.2 p2VulnerableA10
cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.2:p3:*:*:*:*:*:*4.1.2 p3VulnerableA10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p7:*:*:*:*:*:* Versions 2.7.2 p7 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p7-sp3:*:*:*:*:*:* Versions 2.7.2 p7-sp3 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p8:*:*:*:*:*:* Versions 2.7.2 p8 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:2.7.2:p9:*:*:*:*:*:* Versions 2.7.2 p9 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p1:*:*:*:*:*:* Versions 4.1.0 p1 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p10:*:*:*:*:*:* Versions 4.1.0 p10 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p2:*:*:*:*:*:* Versions 4.1.0 p2 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p3:*:*:*:*:*:* Versions 4.1.0 p3 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p4:*:*:*:*:*:* Versions 4.1.0 p4 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p5:*:*:*:*:*:* Versions 4.1.0 p5 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p6:*:*:*:*:*:* Versions 4.1.0 p6 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p7:*:*:*:*:*:* Versions 4.1.0 p7 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p8:*:*:*:*:*:* Versions 4.1.0 p8 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.0:p9:*:*:*:*:*:* Versions 4.1.0 p9 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p1:*:*:*:*:*:* Versions 4.1.1 p1 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p2:*:*:*:*:*:* Versions 4.1.1 p2 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p3:*:*:*:*:*:* Versions 4.1.1 p3 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p4:*:*:*:*:*:* Versions 4.1.1 p4 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p5:*:*:*:*:*:* Versions 4.1.1 p5 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p6:*:*:*:*:*:* Versions 4.1.1 p6 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.1:p7:*:*:*:*:*:* Versions 4.1.1 p7 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.2:p1:*:*:*:*:*:* Versions 4.1.2 p1 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.2:p2:*:*:*:*:*:* Versions 4.1.2 p2 Vulnerable ·A10
  • cpe:2.3:a:a10networks:acos_web_application_firewall:4.1.2:p3:*:*:*:*:*:* Versions 4.1.2 p3 Vulnerable ·A10

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-15904
  2. 2026-10-03 Alias added: GHSA-xmhq-c3vw-6j9m

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences