CVE-2024-3400: Command Injection Vulnerability in Palo Alto Networks PAN-OS | Grey Noise Blog
Summary: On April 12, 2024, Palo Alto Networks announced CVE-2024-3400, a CVSS 10 arbitrary file-write vulnerability in PAN-OS versions 10.2, 11.0, and 11.1 that lets unauthenticated attackers run arbitrary Linux commands with root privileges on firewalls configured with a GlobalProtect gateway or portal and device telemetry enabled. Palo Alto and Unit 42 confirmed limited in-the-wild exploitation, CISA added it to the KEV catalog the same day, and Palo Alto released workaround guidance and some hotfixes on April 14, while GreyNoise reported no exploitation attempts against its fleet as of April 15, 2024, 17:00 UTC.
What's compelling: A CVSS 10 flaw that grants root on the firewall guarding the perimeter is already confirmed exploited in the wild, and GreyNoise's sighting of nonworking public exploits signals that working code and opportunistic scanning will follow quickly.
Read the original at GreyNoise Blog ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2024-3400
- Related
- CVE-2024-3400: Palo Alto Networks PAN-OS Command Injection Vulnerability Known Exploited Vulnerabilities · Apr 12, 2024