Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474 (Updated Nov. 22)
Summary: Unit 42 is tracking exploitation of two PAN-OS flaws under the name Operation Lunar Peek: CVE-2024-0012, an authentication bypass that lets an unauthenticated attacker with network access to the management interface gain administrator privileges, and CVE-2024-9474, a privilege escalation that can be chained with it. Originally reported Nov. 18, 2024 against a limited number of management web interfaces, activity rose notably after third-party researchers published technical details on Nov. 19, with Unit 42 assessing with high confidence that a functional exploit chaining both CVEs is publicly available.
What's compelling: Post-compromise activity has already included interactive command execution and obfuscated web shells dropped on firewalls, and the payload mix has since widened to open-source C2 tools and crypto miners - so a firewall with its management interface reachable from the internet is both an entry point and a place an adversary can live.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-0012CVE-2024-9474
- Related
- CVE-2024-0012: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Nov 18, 2024CVE-2024-9474: Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability Known Exploited Vulnerabilities · Nov 18, 2024Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026