Command injection in the VPN feature of PAN-OS allowed attackers to run commands as root on the firewall itself. What to learn about edge devices.
Publicly disclosed: 12 April 2024
On 12 April 2024 Palo Alto Networks disclosed a vulnerability in PAN-OS, the operating system of its firewalls, that was already being exploited. Through the GlobalProtect VPN feature an unauthenticated attacker could run commands with root privileges on the firewall — the device that is supposed to protect the network.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2024-3400 | Critical, CVSS 10.0 (command injection) | PAN-OS 10.2, 11.0, 11.1 with GlobalProtect gateway or portal | Hotfixes 10.2.9-h1, 11.0.4-h1, 11.1.2-h3 and later |
Firewalls and VPN gateways are always reachable from the internet, often run without endpoint protection and are monitored less than servers. A compromise gives attackers a hidden foothold at the very entrance to the network.
The device that guards the door must be the most carefully guarded device of all.
Sources: Palo Alto Networks advisory, NVD CVE-2024-3400.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
