Actively exploited · Published Nov 18, 2024 · Assigned by palo_alto

CVE-2024-0012PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

Critical 9.3 Exploited Ransomware

In plain English

A critical-severity missing authentication in Cloud NGFW from Palo Alto Networks. Attackers are actively exploiting it in the wild (listed by CISA on November 18, 2024). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 99.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)99.8%top 0.0% of all CVEs

Exploited in the wildYesCISA KEV since Nov 18, 2024

Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.

Federal agencies must remediate by Dec 9, 2024.

Official description

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
Palo Alto Networks	Cloud NGFW	see references
Palo Alto Networks	PAN-OS	11.2.0 – before 11.2.4-h111.1.0 – before 11.1.5-h111.0.0 – before 11.0.6-h110.2.0 – before 10.2.12-h2
Palo Alto Networks	Prisma Access	see references

Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red