Palo Alto Networks PAN-OS Management Web Interface missing authentication

Summaryinfo

A vulnerability classified as critical has been found in Palo Alto Networks PAN-OS. This issue affects some unknown processing of the component Management Web Interface. This manipulation causes missing authentication. This vulnerability is registered as CVE-2024-0012. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Palo Alto Networks PAN-OS (version now known) and classified as very critical. Affected by this vulnerability is some unknown processing of the component Management Web Interface. The manipulation with an unknown input leads to a missing authentication vulnerability. The CWE definition for the vulnerability is CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

The advisory is shared at security.paloaltonetworks.com. This vulnerability is known as CVE-2024-0012 since 11/09/2023. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but a public exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/13/2025).

It is possible to download the exploit at packetstormsecurity.com. It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 11/18/2024 with a due date of 12/09/2024:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Zero-Day.cz (936). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Palo Alto Networks

Name

• PAN-OS

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion