cnvd - cnvd-2024-46250

cnvd-2024-46250

Vulnerability from cnvd

Title: Palo Alto Networks PAN-OS操作系统命令注入漏洞（CNVD-2024-46250）

Description:

Palo Alto Networks PAN-OS是美国Palo Alto Networks公司的一套为其防火墙设备开发的操作系统。

Palo Alto Networks PAN-OS存在操作系统命令注入漏洞，该漏洞源于存在权限提升漏洞，允许有权访问管理Web界面的PAN-OS管理员以root权限在防火墙上执行操作。目前没有详细的漏洞细节提供。

Severity: 高

Patch Name: Palo Alto Networks PAN-OS操作系统命令注入漏洞（CNVD-2024-46250）的补丁

Patch Description:

Palo Alto Networks PAN-OS是美国Palo Alto Networks公司的一套为其防火墙设备开发的操作系统。

Palo Alto Networks PAN-OS存在操作系统命令注入漏洞，该漏洞源于存在权限提升漏洞，允许有权访问管理Web界面的PAN-OS管理员以root权限在防火墙上执行操作。目前没有详细的漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://security.paloaltonetworks.com/CVE-2024-9474

Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-9474

Impacted products

Name
['Palo Alto Networks PAN-OS 11.2.4', 'Palo Alto Networks PAN-OS >=11.2.0，<11.2.4', 'Palo Alto Networks PAN-OS >=11.1.0，<11.1.5', 'Palo Alto Networks PAN-OS 11.0.6', 'Palo Alto Networks PAN-OS >=11.0.0，<11.0.6', 'Palo Alto Networks PAN-OS 10.2.12', 'Palo Alto Networks PAN-OS >=10.2.0，<10.2.12', 'Palo Alto Networks PAN-OS 11.1.5', 'Palo Alto Networks PAN-OS 10.1.14', 'Palo Alto Networks PAN-OS >=10.1.0，<10.1.14']

Name

['Palo Alto Networks PAN-OS 11.2.4', 'Palo Alto Networks PAN-OS >=11.2.0，<11.2.4', 'Palo Alto Networks PAN-OS >=11.1.0，<11.1.5', 'Palo Alto Networks PAN-OS 11.0.6', 'Palo Alto Networks PAN-OS >=11.0.0，<11.0.6', 'Palo Alto Networks PAN-OS 10.2.12', 'Palo Alto Networks PAN-OS >=10.2.0，<10.2.12', 'Palo Alto Networks PAN-OS 11.1.5', 'Palo Alto Networks PAN-OS 10.1.14', 'Palo Alto Networks PAN-OS >=10.1.0，<10.1.14']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-9474",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9474"
    }
  },
  "description": "Palo Alto Networks PAN-OS\u662f\u7f8e\u56fdPalo Alto Networks\u516c\u53f8\u7684\u4e00\u5957\u4e3a\u5176\u9632\u706b\u5899\u8bbe\u5907\u5f00\u53d1\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\n\nPalo Alto Networks PAN-OS\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u5141\u8bb8\u6709\u6743\u8bbf\u95ee\u7ba1\u7406Web\u754c\u9762\u7684PAN-OS\u7ba1\u7406\u5458\u4ee5root\u6743\u9650\u5728\u9632\u706b\u5899\u4e0a\u6267\u884c\u64cd\u4f5c\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://security.paloaltonetworks.com/CVE-2024-9474",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-46250",
  "openTime": "2024-11-27",
  "patchDescription": "Palo Alto Networks PAN-OS\u662f\u7f8e\u56fdPalo Alto Networks\u516c\u53f8\u7684\u4e00\u5957\u4e3a\u5176\u9632\u706b\u5899\u8bbe\u5907\u5f00\u53d1\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nPalo Alto Networks PAN-OS\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u5141\u8bb8\u6709\u6743\u8bbf\u95ee\u7ba1\u7406Web\u754c\u9762\u7684PAN-OS\u7ba1\u7406\u5458\u4ee5root\u6743\u9650\u5728\u9632\u706b\u5899\u4e0a\u6267\u884c\u64cd\u4f5c\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Palo Alto Networks PAN-OS\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2024-46250\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Palo Alto Networks PAN-OS 11.2.4",
      "Palo Alto Networks PAN-OS \u003e=11.2.0\uff0c\u003c11.2.4",
      "Palo Alto Networks PAN-OS \u003e=11.1.0\uff0c\u003c11.1.5",
      "Palo Alto Networks PAN-OS 11.0.6",
      "Palo Alto Networks PAN-OS \u003e=11.0.0\uff0c\u003c11.0.6",
      "Palo Alto Networks PAN-OS 10.2.12",
      "Palo Alto Networks PAN-OS \u003e=10.2.0\uff0c\u003c10.2.12",
      "Palo Alto Networks PAN-OS 11.1.5",
      "Palo Alto Networks PAN-OS 10.1.14",
      "Palo Alto Networks PAN-OS \u003e=10.1.0\uff0c\u003c10.1.14"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-9474",
  "serverity": "\u9ad8",
  "submitTime": "2024-11-26",
  "title": "Palo Alto Networks PAN-OS\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2024-46250\uff09"
}

CVE-2024-9474 (GCVE-0-2024-9474)

Vulnerability from cvelistv5

Published

2024-11-18 15:48

Modified

2025-07-30 01:36

Severity ?

6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red
5.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

References

▼	URL	Tags
	https://security.paloaltonetworks.com/CVE-2024-9474	vendor-advisory

Impacted products

Vendor

Product

Version

▼

Palo Alto Networks

Cloud NGFW

	Palo Alto Networks	PAN-OS	Version: 11.2.0 < 11.2.4-h1 Version: 11.1.0 < 11.1.5-h1 Version: 11.0.0 < 11.0.6-h1 Version: 10.2.0 < 10.2.12-h2 Version: 10.1.0 < 10.1.14-h6
	Palo Alto Networks	Prisma Access

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:paloaltonetworks:pan-os:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pan-os",
            "vendor": "paloaltonetworks",
            "versions": [
              {
                "lessThan": "11.2.4-h1",
                "status": "affected",
                "version": "11.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "11.1.5-h1",
                "status": "affected",
                "version": "11.1.0",
                "versionType": "custom"
              },
              {
                "lessThan": "11.0.6-h1",
                "status": "affected",
                "version": "11.0.0",
                "versionType": "custom"
              },
              {
                "lessThan": "10.2.12-h2",
                "status": "affected",
                "version": "10.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "10.1.14-h6",
                "status": "affected",
                "version": "10.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:paloaltonetworks:pan-os:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pan-os",
            "vendor": "paloaltonetworks",
            "versions": [
              {
                "lessThan": "11.2.4-h1",
                "status": "affected",
                "version": "11.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "11.1.5-h1",
                "status": "affected",
                "version": "11.1.0",
                "versionType": "custom"
              },
              {
                "lessThan": "11.0.6-h1",
                "status": "affected",
                "version": "11.0.0",
                "versionType": "custom"
              },
              {
                "lessThan": "10.2.12-h2",
                "status": "affected",
                "version": "10.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "10.1.14-h6",
                "status": "affected",
                "version": "10.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:paloaltonetworks:pan-os:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pan-os",
            "vendor": "paloaltonetworks",
            "versions": [
              {
                "lessThan": "11.2.4-h1",
                "status": "affected",
                "version": "11.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "11.1.5-h1",
                "status": "affected",
                "version": "11.1.0",
                "versionType": "custom"
              },
              {
                "lessThan": "11.0.6-h1",
                "status": "affected",
                "version": "11.0.0",
                "versionType": "custom"
              },
              {
                "lessThan": "10.2.12-h2",
                "status": "affected",
                "version": "10.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "10.1.14-h6",
                "status": "affected",
                "version": "10.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:paloaltonetworks:pan-os:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pan-os",
            "vendor": "paloaltonetworks",
            "versions": [
              {
                "lessThan": "11.2.4-h1",
                "status": "affected",
                "version": "11.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "11.1.5-h1",
                "status": "affected",
                "version": "11.1.0",
                "versionType": "custom"
              },
              {
                "lessThan": "11.0.6-h1",
                "status": "affected",
                "version": "11.0.0",
                "versionType": "custom"
              },
              {
                "lessThan": "10.2.12-h2",
                "status": "affected",
                "version": "10.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "10.1.14-h6",
                "status": "affected",
                "version": "10.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:paloaltonetworks:pan-os:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pan-os",
            "vendor": "paloaltonetworks",
            "versions": [
              {
                "lessThan": "11.2.4-h1",
                "status": "affected",
                "version": "11.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "11.1.5-h1",
                "status": "affected",
                "version": "11.1.0",
                "versionType": "custom"
              },
              {
                "lessThan": "11.0.6-h1",
                "status": "affected",
                "version": "11.0.0",
                "versionType": "custom"
              },
              {
                "lessThan": "10.2.12-h2",
                "status": "affected",
                "version": "10.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "10.1.14-h6",
                "status": "affected",
                "version": "10.1.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9474",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-19T04:55:45.920877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2024-11-18",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9474"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-30T01:36:25.829Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "url": "https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/k4nfr3/CVE-2024-9474"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2024-11-18T00:00:00+00:00",
            "value": "CVE-2024-9474 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-11-24T14:45:36.690Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Cloud NGFW",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "All"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PAN-OS",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "11.2.4-h1",
                  "status": "unaffected"
                }
              ],
              "lessThan": "11.2.4-h1",
              "status": "affected",
              "version": "11.2.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "11.1.5-h1",
                  "status": "unaffected"
                }
              ],
              "lessThan": "11.1.5-h1",
              "status": "affected",
              "version": "11.1.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "11.0.6-h1",
                  "status": "unaffected"
                }
              ],
              "lessThan": "11.0.6-h1",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "10.2.12-h2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "10.2.12-h2",
              "status": "affected",
              "version": "10.2.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "10.1.14-h6",
                  "status": "unaffected"
                }
              ],
              "lessThan": "10.1.14-h6",
              "status": "affected",
              "version": "10.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Prisma Access",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "All"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe risk is greatest if you configure the management interface to enable access from the internet or any untrusted network either:\u003c/p\u003e\u003col\u003e\u003cli\u003eDirectly\u003cbr /\u003eor\u003c/li\u003e\u003cli\u003eThrough a dataplane interface that includes a management interface profile.\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eThe risk is greatly reduced if you make sure that only trusted internal IP addresses are allowed to access the management interface.\u003c/p\u003e\u003cp\u003eUse the following steps to identify your recently detected devices in our Internet scans:\u003c/p\u003e\u003col\u003e\u003cli\u003eTo find your known assets that require remediation action, visit the Assets section of Customer Support Portal at \u003ca target=\"_blank\" href=\"https://support.paloaltonetworks.com/\"\u003ehttps://support.paloaltonetworks.com\u003c/a\u003e\u00a0(Products \u2192 Assets \u2192 All Assets \u2192 Remediation Required).\u003c/li\u003e\u003cli\u003eThe list of your known devices with an internet-facing management interface discovered in our scans are tagged with PAN-SA-2024-0015 with a last seen timestamp in UTC. If no such devices are listed, it indicates our scan did not find any devices with internet-facing management interface for your account in the last three days.\u003c/li\u003e\u003c/ol\u003e"
            }
          ],
          "value": "The risk is greatest if you configure the management interface to enable access from the internet or any untrusted network either:\n\n  *  Directly\nor\n  *  Through a dataplane interface that includes a management interface profile.\nThe risk is greatly reduced if you make sure that only trusted internal IP addresses are allowed to access the management interface.\n\nUse the following steps to identify your recently detected devices in our Internet scans:\n\n  *  To find your known assets that require remediation action, visit the Assets section of Customer Support Portal at  https://support.paloaltonetworks.com https://support.paloaltonetworks.com/ \u00a0(Products \u2192 Assets \u2192 All Assets \u2192 Remediation Required).\n  *  The list of your known devices with an internet-facing management interface discovered in our scans are tagged with PAN-SA-2024-0015 with a last seen timestamp in UTC. If no such devices are listed, it indicates our scan did not find any devices with internet-facing management interface for your account in the last three days."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Palo Alto Networks thanks our Deep Product Security Research Team for discovering this issue internally from threat activity."
        }
      ],
      "datePublic": "2024-11-18T14:20:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.\u003c/p\u003e\u003cp\u003eCloud NGFW and Prisma Access are not impacted by this vulnerability.\u003c/p\u003e"
            }
          ],
          "value": "A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.\n\nCloud NGFW and Prisma Access are not impacted by this vulnerability."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan\u003ePalo Alto Networks observed threat activity that exploits this vulnerability against a limited number of management web interfaces that are exposed to internet traffic coming from outside the network.\u003c/span\u003e\u003cbr /\u003e"
            }
          ],
          "value": "Palo Alto Networks observed threat activity that exploits this vulnerability against a limited number of management web interfaces that are exposed to internet traffic coming from outside the network."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "RED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "The risk is highest when you allow access to the management interface from external IP addresses on the internet. The worst impact is that a malicious administrator is able to tamper with the system integrity."
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "RED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "If you configure a specific list of IP addresses that only allow access to the management interface, you greatly reduce the risk of exploitation because attacks would require privileged access using only those IP addresses."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-18T15:48:23.405Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2024-9474"
        }
      ],
      "solutions": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThis issue is fixed in PAN-OS 10.1.14-h6, PAN-OS 10.2.12-h2, PAN-OS 11.0.6-h1, PAN-OS 11.1.5-h1, PAN-OS 11.2.4-h1, and all later PAN-OS versions.\u003c/p\u003e\u003cp\u003eIn addition, in an attempt to provide the most seamless upgrade path for our customers, we are making fixes available for other TAC-preferred and commonly deployed maintenance releases.\u003c/p\u003e\u003cdiv\u003e\u003cul\u003e\u003cli\u003eAdditional PAN-OS 11.2 fixes:\u003cul\u003e\u003cli\u003e\u200b\u200b11.2.0-h1\u003c/li\u003e\u003cli\u003e11.2.1-h1\u003c/li\u003e\u003cli\u003e11.2.2-h2\u003c/li\u003e\u003cli\u003e11.2.3-h3\u003c/li\u003e\u003cli\u003e11.2.4-h1\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003eAdditional PAN-OS 11.1 fixes:\u003cul\u003e\u003cli\u003e11.1.0-h4\u003c/li\u003e\u003cli\u003e11.1.1-h2\u003c/li\u003e\u003cli\u003e11.1.2-h15\u003c/li\u003e\u003cli\u003e11.1.3-h11\u003c/li\u003e\u003cli\u003e11.1.4-h7\u003c/li\u003e\u003cli\u003e11.1.5-h1\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003eAdditional PAN-OS 11.0 fixes:\u003cul\u003e\u003cli\u003e11.0.0-h4\u003c/li\u003e\u003cli\u003e11.0.1-h5\u003c/li\u003e\u003cli\u003e11.0.2-h5\u003c/li\u003e\u003cli\u003e11.0.3-h13\u003c/li\u003e\u003cli\u003e11.0.4-h6\u003c/li\u003e\u003cli\u003e11.0.5-h2\u003c/li\u003e\u003cli\u003e11.0.6-h1\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003eAdditional PAN-OS 10.2 fixes:\u003cul\u003e\u003cli\u003e10.2.0-h4\u003c/li\u003e\u003cli\u003e10.2.1-h3\u003c/li\u003e\u003cli\u003e10.2.2-h6\u003c/li\u003e\u003cli\u003e10.2.3-h14\u003c/li\u003e\u003cli\u003e10.2.4-h32\u003c/li\u003e\u003cli\u003e10.2.5-h9\u003c/li\u003e\u003cli\u003e10.2.6-h6\u003c/li\u003e\u003cli\u003e10.2.7-h18\u003c/li\u003e\u003cli\u003e10.2.8-h15\u003c/li\u003e\u003cli\u003e10.2.9-h16\u003c/li\u003e\u003cli\u003e10.2.10-h9\u003c/li\u003e\u003cli\u003e10.2.11-h6\u003c/li\u003e\u003cli\u003e10.2.12-h2\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003eAdditional PAN-OS 10.1 fixes:\u003cul\u003e\u003cli\u003e10.1.9-h14\u003c/li\u003e\u003cli\u003e10.1.10-h9\u003c/li\u003e\u003cli\u003e10.1.11-h10\u003c/li\u003e\u003cli\u003e10.1.12-h3\u003c/li\u003e\u003cli\u003e10.1.13-h5\u003c/li\u003e\u003cli\u003e10.1.14-h6\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e"
            }
          ],
          "value": "This issue is fixed in PAN-OS 10.1.14-h6, PAN-OS 10.2.12-h2, PAN-OS 11.0.6-h1, PAN-OS 11.1.5-h1, PAN-OS 11.2.4-h1, and all later PAN-OS versions.\n\nIn addition, in an attempt to provide the most seamless upgrade path for our customers, we are making fixes available for other TAC-preferred and commonly deployed maintenance releases.\n\n  *  Additional PAN-OS 11.2 fixes:  *  \u200b\u200b11.2.0-h1\n  *  11.2.1-h1\n  *  11.2.2-h2\n  *  11.2.3-h3\n  *  11.2.4-h1\n\n\n\n  *  Additional PAN-OS 11.1 fixes:  *  11.1.0-h4\n  *  11.1.1-h2\n  *  11.1.2-h15\n  *  11.1.3-h11\n  *  11.1.4-h7\n  *  11.1.5-h1\n\n\n\n  *  Additional PAN-OS 11.0 fixes:  *  11.0.0-h4\n  *  11.0.1-h5\n  *  11.0.2-h5\n  *  11.0.3-h13\n  *  11.0.4-h6\n  *  11.0.5-h2\n  *  11.0.6-h1\n\n\n\n  *  Additional PAN-OS 10.2 fixes:  *  10.2.0-h4\n  *  10.2.1-h3\n  *  10.2.2-h6\n  *  10.2.3-h14\n  *  10.2.4-h32\n  *  10.2.5-h9\n  *  10.2.6-h6\n  *  10.2.7-h18\n  *  10.2.8-h15\n  *  10.2.9-h16\n  *  10.2.10-h9\n  *  10.2.11-h6\n  *  10.2.12-h2\n\n\n\n  *  Additional PAN-OS 10.1 fixes:  *  10.1.9-h14\n  *  10.1.10-h9\n  *  10.1.11-h10\n  *  10.1.12-h3\n  *  10.1.13-h5\n  *  10.1.14-h6"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-11-18T14:00:00.000Z",
          "value": "Initial publication"
        }
      ],
      "title": "PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan\u003eRecommended mitigation\u2014The vast majority of firewalls already follow Palo Alto Networks and industry best practices. However, if you haven\u2019t already, we strongly recommend that you secure access to your management interface according to our best practice deployment guidelines. Specifically, you should restrict access to the management interface to only trusted internal IP addresses to prevent external access from the internet.\u003c/span\u003e\u003cbr /\u003e\u003cp\u003e\u003cspan\u003eReview information about how to secure management access to your Palo Alto Networks firewalls:\u003c/span\u003e\u003c/p\u003e\u003cspan\u003e\u003cul\u003e\u003cli\u003e\u003cspan\u003ePalo Alto Networks LIVEcommunity article:\u00a0\u003c/span\u003e\u003ca target=\"_blank\" href=\"https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431\"\u003e\u003cspan\u003ehttps://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431\u003c/span\u003e\u003c/a\u003e\u003c/li\u003e\u003cli\u003ePalo Alto Networks official and more detailed technical documentation:\u00a0\u003ca target=\"_blank\" href=\"https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices\"\u003ehttps://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/span\u003e"
            }
          ],
          "value": "Recommended mitigation\u2014The vast majority of firewalls already follow Palo Alto Networks and industry best practices. However, if you haven\u2019t already, we strongly recommend that you secure access to your management interface according to our best practice deployment guidelines. Specifically, you should restrict access to the management interface to only trusted internal IP addresses to prevent external access from the internet.\nReview information about how to secure management access to your Palo Alto Networks firewalls:\n\n  *  Palo Alto Networks LIVEcommunity article:\u00a0 https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2024-9474",
    "datePublished": "2024-11-18T15:48:23.405Z",
    "dateReserved": "2024-10-03T11:35:20.568Z",
    "dateUpdated": "2025-07-30T01:36:25.829Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted