Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2024-0012

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

PAN-OS 10.2, 11.0, 11.1 and 11.2 on PA-Series, VM-Series, CN-Series firewalls and Panorama, when the management interface is reachable from untrusted networks. Fixed in 10.2.12-h2, 11.0.6-h1, 11.1.5-h1 and 11.2.4-h1.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
Fix
Fixed in 11.2.4-h1, 11.1.5-h1, 11.0.6-h1, 10.2.12-h2
None on Exploit-DB, Metasploit or GitHub

Summary

Palo Alto Networks PAN-OS firewall software is affected. An unauthenticated attacker with network access to the management web interface could bypass authentication and gain administrator privileges, allowing them to change the device configuration and perform administrative actions.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Timeline

  1. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  2. CVE published
  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Palo Alto Networks Cloud NGFW

    Version range not reported

  • Palo Alto Networks PAN-OS

    From 11.2.0 · fixed in 11.2.4-h1; From 11.1.0 · fixed in 11.1.5-h1; From 11.0.0 · fixed in 11.0.6-h1; From 10.2.0 · fixed in 10.2.12-h2

  • Palo Alto Networks Prisma Access

    Version range not reported

References 1

security.paloaltonetworks.com

FAQ

Questions about CVE-2024-0012

What does this mean?

An unauthenticated attacker can gain PAN-OS administrator privileges through the management web interface. With those privileges, they can perform administrative actions and tamper with the configuration.Source: security.paloaltonetworks.com

Am I affected, and how do I check?

The issue applies to PAN-OS 10.2, 11.0, 11.1 and 11.2 on PA-Series, VM-Series and CN-Series firewalls and on Panorama (virtual and M-Series). Risk is greatest when the management interface is reachable from the internet or an untrusted network, or when a management profile is set on interfaces with GlobalProtect portals or gateways. The PAN-OS version can be checked with the show system info command.Source: security.paloaltonetworks.com

What should I do about it?

Upgrade to PAN-OS 10.2.12-h2, 11.0.6-h1, 11.1.5-h1, 11.2.4-h1 or a later version. If upgrading is not possible, restrict access to the management interface to trusted internal IP addresses only.Source: security.paloaltonetworks.com

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-11-18, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data