CVE-2020-1979CWE-134

PAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalation

High · published March 11, 2020

CVSS v3.1
8.1
EPSS
1%
Percentile
62.5
In the wild
Unconfirmed
What it is

A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code, bypassing the restricted shell and escalating privileges. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13 on Panorama. This issue does not affect PAN-OS 7.1, PAN-OS 9.0, or later PAN-OS versions.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01001 · 62.5th percentile
Weakness
CWE-134 · Use of Externally-Controlled Format String
Published
2020-03-11T18:58Z
EPSS history
Timeline
  • 11 MAR 18:58Z
    PAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalation
    cvelistv5