CVE-2024-3400 — CRITICAL (10.0)

Vulnerability Description

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

CVSS Score

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Paloaltonetworks	Pan-Os	10.2.0

Related Weaknesses (CWE)

CWE-20 CWE-77

References

https://security.paloaltonetworks.com/CVE-2024-3400Vendor Advisory
https://unit42.paloaltonetworks.com/cve-2024-3400/ExploitVendor Advisory
https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/Technical DescriptionVendor Advisory
https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticateExploitThird Party Advisory
https://security.paloaltonetworks.com/CVE-2024-3400Vendor Advisory
https://unit42.paloaltonetworks.com/cve-2024-3400/ExploitVendor Advisory
https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/Technical DescriptionVendor Advisory
https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticateExploitThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-US Government Resource

FAQ

What is CVE-2024-3400?

CVE-2024-3400 is a vulnerability with a CVSS score of 10.0 (CRITICAL). A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurat...

How severe is CVE-2024-3400?

CVE-2024-3400 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2024-3400?

Check the references section above for vendor advisories and patch information. Affected products include: Paloaltonetworks Pan-Os.