Back
CVE-2024-3400: A Critical Vulnerability in PAN-OS

CVE-2024-3400: A Critical Vulnerability in PAN-OS

WARNING Publication date: 2024-04-17

Understanding CVE-2024-3400: A Critical Vulnerability in PAN-OS

Introduction On April 12, 2024, a critical vulnerability identified as CVE-2024-3400 was disclosed by Palo Alto Networks. This vulnerability affects certain versions of PAN-OS, the operating system used in their network security appliances, specifically within the GlobalProtect feature.

Description of the Vulnerability CVE-2024-3400 is an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code with root privileges on affected devices. This vulnerability is categorized under CWE-77, indicating improper neutralization of special elements used in a command ('Command Injection').

Affected Versions The issue affects multiple versions of PAN-OS under specific configurations:

  • PAN-OS 10.2 versions prior to 10.2.9-h1
  • PAN-OS 11.0 versions before 11.0.4-h1
  • PAN-OS 11.1 up to and not including 11.1.2-h3

It is important to note that only devices configured with GlobalProtect gateway or portal are susceptible to this exploit. Neither Cloud NGFW, Panorama appliances, nor Prisma Access environments are impacted.

Checking Vulnerability To determine if your firewall is vulnerable:

  1. Check PAN-OS Version: Access your firewall interface, navigate to 'Device' > 'Software' and check the version of PAN-OS running. If it's one of the affected versions mentioned above and has not been updated to the indicated patched versions, it's potentially at risk.

  2. Verify Configuration: Go to 'Network' > 'GlobalProtect' > 'Gateways' or 'Portals'. If you have these configurations active, your system is at risk of being exploited through this vulnerability.

Mitigation and Fixes Palo Alto Networks has already released hotfixes for the affected versions. It's crucial for administrators to apply these updates immediately. The specific fixed versions include:

  • PAN-OS 10.2.9-h1
  • PAN-OS 11.0.4-h1
  • PAN-OS 11.1.2-h3

Preventative Measures In addition to applying the hotfixes, Palo Alto Networks recommends:

  • Applying Threat Prevention IDs: With a Threat Prevention subscription, customers can use IDs 95187, 95189, and 95191 to block potential attacks exploiting this CVE.
  • Regular Monitoring: Continue monitoring Palo Alto Networks advisories for updates on new threats and additional IDs.

Conclusion CVE-2024-3400 is a critical vulnerability that requires immediate attention from network administrators using affected versions of PAN-OS with GlobalProtect configurations. By following the guidelines for checking system vulnerability, applying necessary patches, and utilizing threat prevention measures, organizations can protect their networks from potential exploits. For more detailed information and continued updates, customers should refer to the website of Palo Alto Networks regarding this CVE: