by Kastro
Paper/Archive/CVE-2024-3400

CVE-2024-3400

Palo Alto Networks PAN-OS — PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

KEV · due 19 Aprransomware useEPSS 100%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Affected

ProductAffectedFixed inSource
PAN-OS10.2.0 – < 10.2.9-h110.2.9-h1CNA
PAN-OS11.0.0 – < 11.0.4-h111.0.4-h1CNA
PAN-OS11.1.0 – < 11.1.2-h311.1.2-h3CNA
Cloud NGFWsee advisoryAllCNA
Prisma Accesssee advisoryAllCNA
pan-os10.2.0 – < 10.2.9-h110.2.9-h1CISA-ADP
pan-os11.0.0 – < 11.0.4-h111.0.4-h1CISA-ADP
pan-os11.1.0 – < 11.1.2-h311.1.2-h3CISA-ADP

Scores by source

palo_alto (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisorysecurity.paloaltonetworks.com/CVE-2024-3400writeupunit42.paloaltonetworks.com/cve-2024-3400writeupvolexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400writeuppaloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cverefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400kevcisa.gov/known-exploited-vulnerabilities-catalog