CVE-2020-2000CWE-121CWE-20CWE-78

PAN-OS: OS command injection and memory corruption vulnerability

High · published November 12, 2020

CVSS v3.1
7.2
EPSS
3%
Percentile
88.6
In the wild
Unconfirmed
What it is

An OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allows authenticated administrators to disrupt system processes and potentially execute arbitrary code and OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03366 · 88.6th percentile
Weaknesses
CWE-121 · Stack-based Buffer Overflow; CWE-20 · Improper Input Validation; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2020-11-12T00:05Z
EPSS history
Timeline
  • 12 NOV 00:05Z
    PAN-OS: OS command injection and memory corruption vulnerability
    cvelistv5