2024-037: Critical Vulnerability in PAN-OS software

2024-037: Critical Vulnerability in PAN-OS software ↗ source

April 29, 2024 CERT-EU Advisory

Source: https://cert.europa.eu/publications/security-advisories/2024-037/

Summary

This vulnerability allows an unauthenticated remote attacker to execute arbitrary code as root on the affected device [1]. This vulnerability is being exploited in the wild, and proof-of-concepts have been publicly disclosed by third parties [4]. The vendor is gradually releasing patches for the vulnerable versions since April 14, 2024. However, the patches are not available for all the affected versions yet. In this case, it is highly recommended to apply the mitigation measures, as well as implementing the verification steps suggested by the vendor.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2024-3400	10.0 Critical	Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute command…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Palo Alto Networks 15 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.