by Kastro
Paper/Archive/CVE-2020-2040

CVE-2020-2040

Palo Alto Networks PAN-OS — PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled

EPSS 4%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 90.4.904 × 2018.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.

Affected

ProductAffectedFixed inSource
PAN-OS8.0.*–CNA
PAN-OS9.0 – < 9.0.99.0.9CNA
PAN-OS9.1 – < 9.1.39.1.3CNA
PAN-OS8.1 – < 8.1.158.1.15CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
palo_alto (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsecurity.paloaltonetworks.com/CVE-2020-2040