Actively exploited in the wild
Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
Palo Alto Networks - PAN-OS · Listed in the CISA KEV since 2024-11-18. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.
CVE-2024-9474
HighCVSS 7.2KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Risk Assessment
The risk is that an administrator (even with limited privileges) can gain full control over the firewall, potentially leading to compromise of the entire network.
Recommendation
It is recommended to restrict access to the management interface to trusted administrators only and apply available patches from the vendor.
Original NVD description (English source)
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.