Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-3400

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Published

2024-04-12T08:15:06.230

Last Modified

2024-11-29T16:47:54.893

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 10.0 (CRITICAL)

Weaknesses

Type: Secondary
CWE-20
CWE-77
Type: Primary
CWE-77

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	paloaltonetworks	pan-os	10.2.0	Yes
Operating System	paloaltonetworks	pan-os	10.2.0	Yes
Operating System	paloaltonetworks	pan-os	10.2.0	Yes
Operating System	paloaltonetworks	pan-os	10.2.1	Yes
Operating System	paloaltonetworks	pan-os	10.2.1	Yes
Operating System	paloaltonetworks	pan-os	10.2.2	Yes
Operating System	paloaltonetworks	pan-os	10.2.2	Yes
Operating System	paloaltonetworks	pan-os	10.2.2	Yes
Operating System	paloaltonetworks	pan-os	10.2.2	Yes
Operating System	paloaltonetworks	pan-os	10.2.3	Yes
Operating System	paloaltonetworks	pan-os	10.2.3	Yes
Operating System	paloaltonetworks	pan-os	10.2.3	Yes
Operating System	paloaltonetworks	pan-os	10.2.3	Yes
Operating System	paloaltonetworks	pan-os	10.2.3	Yes
Operating System	paloaltonetworks	pan-os	10.2.3	Yes
Operating System	paloaltonetworks	pan-os	10.2.4	Yes
Operating System	paloaltonetworks	pan-os	10.2.4	Yes
Operating System	paloaltonetworks	pan-os	10.2.4	Yes
Operating System	paloaltonetworks	pan-os	10.2.4	Yes
Operating System	paloaltonetworks	pan-os	10.2.4	Yes
Operating System	paloaltonetworks	pan-os	10.2.5	Yes
Operating System	paloaltonetworks	pan-os	10.2.5	Yes
Operating System	paloaltonetworks	pan-os	10.2.5	Yes
Operating System	paloaltonetworks	pan-os	10.2.6	Yes
Operating System	paloaltonetworks	pan-os	10.2.6	Yes
Operating System	paloaltonetworks	pan-os	10.2.7	Yes
Operating System	paloaltonetworks	pan-os	10.2.7	Yes
Operating System	paloaltonetworks	pan-os	10.2.7	Yes
Operating System	paloaltonetworks	pan-os	10.2.7	Yes
Operating System	paloaltonetworks	pan-os	10.2.8	Yes
Operating System	paloaltonetworks	pan-os	10.2.9	Yes
Operating System	paloaltonetworks	pan-os	11.0.0	Yes
Operating System	paloaltonetworks	pan-os	11.0.0	Yes
Operating System	paloaltonetworks	pan-os	11.0.0	Yes
Operating System	paloaltonetworks	pan-os	11.0.1	Yes
Operating System	paloaltonetworks	pan-os	11.0.1	Yes
Operating System	paloaltonetworks	pan-os	11.0.1	Yes
Operating System	paloaltonetworks	pan-os	11.0.2	Yes
Operating System	paloaltonetworks	pan-os	11.0.2	Yes
Operating System	paloaltonetworks	pan-os	11.0.2	Yes
Operating System	paloaltonetworks	pan-os	11.0.2	Yes
Operating System	paloaltonetworks	pan-os	11.0.3	Yes
Operating System	paloaltonetworks	pan-os	11.0.3	Yes
Operating System	paloaltonetworks	pan-os	11.0.3	Yes
Operating System	paloaltonetworks	pan-os	11.0.3	Yes
Operating System	paloaltonetworks	pan-os	11.0.4	Yes
Operating System	paloaltonetworks	pan-os	11.1.0	Yes
Operating System	paloaltonetworks	pan-os	11.1.0	Yes
Operating System	paloaltonetworks	pan-os	11.1.0	Yes
Operating System	paloaltonetworks	pan-os	11.1.1	Yes
Operating System	paloaltonetworks	pan-os	11.1.2	Yes
Operating System	paloaltonetworks	pan-os	11.1.2	Yes

References

https://security.paloaltonetworks.com/CVE-2024-3400 Vendor Advisory ([email protected])
https://unit42.paloaltonetworks.com/cve-2024-3400/ Exploit, Vendor Advisory ([email protected])
https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/ Technical Description, Vendor Advisory ([email protected])
https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/ Exploit, Third Party Advisory ([email protected])
https://security.paloaltonetworks.com/CVE-2024-3400 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://unit42.paloaltonetworks.com/cve-2024-3400/ Exploit, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/ Technical Description, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/ Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)