Vulnerability · Published Nov 10, 2021 · Assigned by palo_alto

CVE-2021-3059PAN-OS: OS Command Injection Vulnerability When Performing Dynamic Updates

High 8.1

In plain English

A high-severity OS command injection in PAN-OS from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)1.5%top 25.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables a man-in-the-middle attacker to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers that have Prisma Access 2.1 Preferred or Prisma Access 2.1 Innovation firewalls are impacted by this issue.

Affected products (as reported)

Vendor	Product	Versions
Palo Alto Networks	PAN-OS	10.0 – before 10.0.810.1 – before 10.1.38.1 – before 8.1.20-h19.0 – before 9.0.14-h39.1 – before 9.1.11-h2
Palo Alto Networks	Prisma Access	2.1 Innovation2.1 Preferred

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://security.paloaltonetworks.com/CVE-2021-3059 x_refsource_MISC