CVE-2024-3400

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2024-04-12

Last updated on: 2025-11-04

Assigner: Palo Alto Networks, Inc.

Description

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2024-04-12

Last Modified

2025-11-04

Generated

2026-11-05

AI Q&A

2024-11-29

EPSS Evaluated

2026-11-03

NVD

CVE-2024-3400

Affected Vendors & Products

Vendor	Product	Version / Range
paloaltonetworks	pan-os	10.2.0
paloaltonetworks	pan-os	10.2.0
paloaltonetworks	pan-os	10.2.0
paloaltonetworks	pan-os	10.2.1
paloaltonetworks	pan-os	10.2.1
paloaltonetworks	pan-os	10.2.2
paloaltonetworks	pan-os	10.2.2
paloaltonetworks	pan-os	10.2.2
paloaltonetworks	pan-os	10.2.2
paloaltonetworks	pan-os	10.2.3
paloaltonetworks	pan-os	10.2.3
paloaltonetworks	pan-os	10.2.3
paloaltonetworks	pan-os	10.2.3
paloaltonetworks	pan-os	10.2.3
paloaltonetworks	pan-os	10.2.3
paloaltonetworks	pan-os	10.2.4
paloaltonetworks	pan-os	10.2.4
paloaltonetworks	pan-os	10.2.4
paloaltonetworks	pan-os	10.2.4
paloaltonetworks	pan-os	10.2.4
paloaltonetworks	pan-os	10.2.5
paloaltonetworks	pan-os	10.2.5
paloaltonetworks	pan-os	10.2.5
paloaltonetworks	pan-os	10.2.6
paloaltonetworks	pan-os	10.2.6
paloaltonetworks	pan-os	10.2.7
paloaltonetworks	pan-os	10.2.7
paloaltonetworks	pan-os	10.2.7
paloaltonetworks	pan-os	10.2.7
paloaltonetworks	pan-os	10.2.8
paloaltonetworks	pan-os	10.2.9
paloaltonetworks	pan-os	11.0.0
paloaltonetworks	pan-os	11.0.0
paloaltonetworks	pan-os	11.0.0
paloaltonetworks	pan-os	11.0.1
paloaltonetworks	pan-os	11.0.1
paloaltonetworks	pan-os	11.0.1
paloaltonetworks	pan-os	11.0.2
paloaltonetworks	pan-os	11.0.2
paloaltonetworks	pan-os	11.0.2
paloaltonetworks	pan-os	11.0.2
paloaltonetworks	pan-os	11.0.3
paloaltonetworks	pan-os	11.0.3
paloaltonetworks	pan-os	11.0.3
paloaltonetworks	pan-os	11.0.3
paloaltonetworks	pan-os	11.0.4
paloaltonetworks	pan-os	11.1.0
paloaltonetworks	pan-os	11.1.0
paloaltonetworks	pan-os	11.1.0
paloaltonetworks	pan-os	11.1.1
paloaltonetworks	pan-os	11.1.2
paloaltonetworks	pan-os	11.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability, identified as CVE-2024-3400, is a serious issue in the GlobalProtect feature of Palo Alto Networks PAN-OS software. It allows an attacker, who does not need to be authenticated, to execute harmful commands on the firewall. This can happen because the software has a flaw that lets unauthorized users create files in a way that can lead to executing arbitrary code with high-level access (root privileges).

Impact Analysis

If you use the affected versions of PAN-OS, this vulnerability could allow attackers to take control of your firewall without needing a password. This means they could potentially disrupt your network, steal sensitive information, or cause other damage. It's crucial to ensure your software is updated to protect against this risk.

Compliance Impact

This vulnerability could put your organization at risk of non-compliance with regulations like GDPR and HIPAA. These regulations require organizations to protect sensitive data and maintain secure systems. If an attacker exploits this vulnerability, it could lead to data breaches or unauthorized access to personal information, which would violate these regulations and could result in legal penalties.

Hi! I’m here to help you understand CVE-2024-3400. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...