⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.. Due date: 2024-12-09.
CVE-2024-9474 — OS Command Injection in Palo Alto Networks Pan-os
Severity
6.9MEDIUMNVD
EPSS
94.2%
top 0.08%
CISA KEV
KEVRansomware
Added 2024-11-18
Due 2024-12-09
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedNov 18
KEV addedNov 18
KEV dueDec 9
Latest updateFeb 19
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.
Description
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.
Cloud NGFW and Prisma Access are not impacted by this vulnerability.
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Packages9 packages
🔴Vulnerability Details
3GHSA▶
GHSA-cgvw-jh5j-mgq3: A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface t↗2024-11-18
💥Exploits & PoCs
2Nuclei▶
PAN-OS Management Web Interface - Command Injection
🔍Detection Rules
1Suricata▶
ET WEB_SPECIFIC_APPS Palo Alto PAN-OS Command Injection in User Parameter (CVE-2024-9474)↗2024-11-19
📋Vendor Advisories
3Palo Alto▶
PAN-SA-2024-0015 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)↗2024-11-18