CVE-2024-8686 — OS Command Injection in Palo Alto Networks Pan-os

CWE-78 — OS Command Injection4 documents4 sources
Severity
8.6HIGHNVD
EPSS
0.3%
top 48.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Paloaltonetworks Pan-osPalo Alto Networks Pan-osPaloalto Cloud Ngfw+2 more
Timeline
PublishedSep 11

Description

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as root on the firewall.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages5 packages

▶NVDpaloaltonetworks/pan-os11.2.0 — 11.2.2
▶CVEListV5palo_alto_networks/pan-os11.2.2
▶Palo Altopaloalto/pan-os

🔴Vulnerability Details

2
GHSA
GHSA-cmm5-px8r-2pcw: A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run a↗2024-09-11
▶
CVEList
PAN-OS: Command Injection Vulnerability↗2024-09-11
▶

📋Vendor Advisories

1
Palo Alto
PAN-OS: Command Injection Vulnerability↗2024-09-11
▶
CVE-2024-8686 — OS Command Injection in Palo | cvebase