PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

Severity

10

CVSS

(AV:N/AC:L/Au:N/C:C/I:C/A:C)

Published

11/18/2024

Created

01/08/2025

Added

01/07/2025

Modified

02/03/2025

Description

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 (https://security.paloaltonetworks.com/CVE-2024-9474). The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines (https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431). This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software on PA-Series, VM-Series, and CN-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Solution(s)

• palo-alto-networks-pan-os-upgrade-latest

References

• https://attackerkb.com/topics/cve-2024-0012
• CVE - 2024-0012
• https://security.paloaltonetworks.com/CVE-2024-0012