CVE-2016-9150
CriticalSummary
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before version 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code.
Risk Assessment
Attackers can exploit this vulnerability to execute arbitrary code remotely, potentially leading to system takeover and serious security implications for the organization.
Recommendation
It is recommended to update PAN-OS to the latest version to mitigate this vulnerability and to monitor the system for potential attack attempts.
Other vulnerabilities in Palo Alto Networks PAN-OS
See all- CVE-2017-15942High
Palo Alto Networks PAN-OS versions before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.13, and 8.0.x before 8.0.6 allow remote attackers to cause a denial of service via vectors related to the management interface.
- CVE-2017-7218High
The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to gain privileges via unspecified request parameters.
- CVE-2016-9151High
Palo Alto Networks PAN-OS versions before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allow local users to gain privileges via crafted values of unspecified environment variables.
- CVE-2016-1712High
Palo Alto Networks PAN-OS versions before 5.0.19, 5.1.x before 5.1.12, 6.0.x before 6.0.14, 6.1.x before 6.1.12, and 7.0.x before 7.0.8 may allow local users to gain privileges by leveraging improper sanitization of the root_reboot local invocation.
- CVE-2016-3654High
The device management command line interface (CLI) in Palo Alto Networks PAN-OS before version 5.0.18 and in versions 5.1.x before 5.1.11, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote authenticated administrators to execute arbitrary OS commands via an SSH command parameter.
- CVE-2026-0284Critical
An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS software allows an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data. Panorama, Cloud NGFW, and Prisma Access are not affected by this vulnerability.
- CVE-2017-15940Critical
The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote authenticated users to execute arbitrary code via unspecified vectors.
- CVE-2016-3655Critical
The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.
- CVE-2026-0301High
An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS software allows an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted.
- CVE-2026-0273High
A command injection vulnerability in Palo Alto Networks PAN-OS software allows an authenticated administrator to bypass system restrictions and run arbitrary commands as root. The user must have access to the PAN-OS CLI or Web UI to exploit this issue.
Original NVD description (English source)
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code via unspecified vectors.