⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.. Due date: 2024-04-19.
CVE-2024-3400 — PAN-OS RCE: Improper Input Validation in PAN-OS GlobalProtect
Severity
10.0CRITICALNVD
EPSS
94.3%
top 0.06%
CISA KEV
KEVRansomware
Added 2024-04-12
Due 2024-04-19
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedApr 12
KEV addedApr 12
KEV dueApr 19
Latest updateJan 12
CISA Required Action: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
Description
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.
Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 3.9 | Impact: 6.0
Affected Packages5 packages
🔴Vulnerability Details
3💥Exploits & PoCs
2Nuclei▶
GlobalProtect - OS Command Injection
🔍Detection Rules
3📋Vendor Advisories
2🕵️Threat Intelligence
13Volexity
▶
Volexity
▶
Bleepingcomputer
▶