CVE-2024-9474

Published Nov 18, 2024

Last updated 5 months ago

Exploit known CVSS medium 6.9

Palo Alto Networks

PAN-OS

Network

Overview

Description: A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Source: psirt@paloaltonetworks.com
NVD status: Analyzed
Products: pan-os

Risk scores

CVSS 4.0

Type: Secondary
Base score: 6.9
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Red
Severity: MEDIUM

CVSS 3.1

Type: Primary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
Exploit added on: Nov 18, 2024
Exploit action due: Dec 9, 2024
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.

Weaknesses

psirt@paloaltonetworks.com: CWE-78
nvd@nist.gov: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "19D52DC1-4441-4C88-B209-9B86FCC2162F",
            "versionEndExcluding": "10.1.14",
            "versionStartIncluding": "10.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "7D294CCB-C898-444E-BD41-D423B96F8E23",
            "versionEndExcluding": "10.2.12",
            "versionStartIncluding": "10.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "47CBEECE-EA41-4A58-8AE9-D695C76D4019",
            "versionEndExcluding": "11.0.6",
            "versionStartIncluding": "11.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "413284AC-F55E-4037-90D4-D63A5FFC20C3",
            "versionEndExcluding": "11.1.5",
            "versionStartIncluding": "11.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "7E4D3A51-0A40-4B19-AAFC-A2484B1CF5D7",
            "versionEndExcluding": "11.2.4",
            "versionStartIncluding": "11.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:*:*:*:*:*:*",
            "matchCriteriaId": "B41A7115-A370-49E1-B162-24803E6DD2CB",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:*:*:*:*:*:*",
            "matchCriteriaId": "65949A49-03A7-491C-B327-127F050AC4F6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:*:*:*:*:*:*",
            "matchCriteriaId": "E8ACB147-B4C1-4964-B538-EAA117CC6DC1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-:*:*:*:*:*:*",
            "matchCriteriaId": "3D33A0FB-7538-42BF-84E8-7CCD7EEF9355",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1:*:*:*:*:*:*",
            "matchCriteriaId": "FB95D77F-1263-4D47-A0BB-94A6DA937115",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.0.6:-:*:*:*:*:*:*",
            "matchCriteriaId": "2B6C3AFF-3649-484C-A2FB-B71EE02FF176",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:-:*:*:*:*:*:*",
            "matchCriteriaId": "7B2C0E11-A6CE-419D-86A0-3930DE25B544",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*",
            "matchCriteriaId": "C01AD190-F3C2-4349-A063-8C5C78B725B9",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 4.0

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References