Palo.Alto.Networks.GlobalProtect.Command.Injection

Description

This indicates an attack attempt to exploit a command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS.
The vulnerability is due to an error in the GlobalProtect when handling a maliciously crafted request. An unauthenticated remote attacker may be able to exploit this to execute arbitrary code with root privileges on the firewall.

Outbreak Alert

The attack on PAN-OS GlobalProtect devices identified as CVE-2024-3400 allows a malicious actor to remotely exploit an unauthenticated command injection vulnerability that leads to remote code execution. Once established, the attacker can further collect configurations, deliver malware payloads and move laterally and internally.

View the full Outbreak Alert Report

Affected Products

PAN-OS 11.1 versions earlier than PAN-OS 11.1.2-h3
PAN-OS 11.0 versions earlier than PAN-OS 11.0.4-h1
PAN-OS 10.2 versions earlier than PAN-OS 10.2.9-h1

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
https://security.paloaltonetworks.com/CVE-2024-3400