CVE-2024-0012KEV ยท OVERDUECWE-306

Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

Critical ยท published November 18, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.

684
days past CISA
deadline
CVSS v3.1
9.8
EPSS
100%
Percentile
100.0
In the wild
Confirmed
What it is

๐Ÿšจ An unauthenticated attacker can waltz right into your PAN-OS management interface, snagging admin privileges like they own the place! ๐Ÿ”ฅ Think of your management web interface as the control room of a space station. If someone gets in without a proper clearance, they could launch any command they want, tampering with the station's mission. ๐Ÿš€ This critical vulnerability could allow an attacker to perform administrative actions, alter configurations, and even exploit other privilege escalation vulnerabilities. Imagine the havoc if they decide to change security settings or, worse, shut down your operations entirely!

Put simply

Think of your management web interface as the control room of a space station. If someone gets in without a proper clearance, they could launch any command they want, tampering with the station's mission. ๐Ÿš€ CVE-2024-0012 is an authentication bypass flaw in Palo Alto Networks PAN-OS that lets unauthenticated users gain administrator access using network access to the management web interface.

What to do

This critical vulnerability could allow an attacker to perform administrative actions, alter configurations, and even exploit other privilege escalation vulnerabilities. Imagine the havoc if they decide to change security settings or, worse, shut down your operations entirely! Secure your management web interface by restricting access to trusted internal IP addresses as per the best practice guidelines. Immediate patching is crucial for versions 10.2, 11.0, 11.1, and 11.2 to mitigate this risk. Don't forget to check the recommendations in Palo Alto Networks' deployment guidelines! You've got this! Follow these steps, and your security hero status will shine brighter than ever! ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
9.8 ยท CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.99855 ยท 100.0th percentile
Weakness
CWE-306 ยท Missing Authentication for Critical Function
Published
2024-11-18T21:15Z
KEV added
2024-11-18 ยท due 2024-12-09
Affected products (117)
ProductVersionsFixed in
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
paloaltonetworks/pan-osall versionsโ€”
References (4)
EPSS history
Timeline
  • 18 NOV 15:47Z
    PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
    cvelistv5
  • 18 NOV 00:00Z
    Added to CISA KEV โ€” remediate by Dec 9
    kev