CVE-2020-2040 — Classic Buffer Overflow in Palo Alto Networks Pan-os

CWE-120 — Classic Buffer Overflow7 documents6 sources
Severity
9.8CRITICALNVD
EPSS
4.0%
top 11.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Palo Alto Networks Pan-osPaloaltonetworks Pan-osPaloalto Pan-os
Timeline
PublishedSep 9
Latest updateMay 24

Description

A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDpaloaltonetworks/pan-os8.1.0 — 8.1.15+3
▶CVEListV5palo_alto_networks/pan-os9.0 — 9.0.9+3
▶Palo Altopaloalto/pan-os

🔴Vulnerability Details

2
GHSA
GHSA-pf79-9hv7-chg5: A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with r↗2022-05-24
▶
CVEList
PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled↗2020-09-09
▶

📋Vendor Advisories

1
Palo Alto
PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled↗2020-09-09
▶

🕵️Threat Intelligence

2
Qualys
PAN-OS Critical Buffer Overflow Vulnerability (CVE-2020-2040) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR®↗2020-09-22
▶
Qualys
PAN-OS Critical Buffer Overflow Vulnerability (CVE-2020-2040) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR® | Qualys↗2020-09-22
▶
CVE-2020-2040 — Classic Buffer Overflow in Palo | cvebase