Palo Alto Networks confirmed two zero-day vulnerabilities were exploited as part of attacks in the wild against PAN-OS devices, with one being attributed to Operation Lunar Peek.

CVE-2024-0012, CVE-2024-9474: Zero-Day Vulnerabilities in Palo Alto PAN-OS Exploited In The Wild

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

CVE-2024-0012: PAN-OS Authentication Bypass Exploited In The Wild (Operation Lunar Peek)

Palo Alto PAN-OS versions 10.2.x < 10.2.12 / 11.0.x < 11.0.6 / 11.1.x < 11.0.5 / 11.2.x < 11.2.4 is affected by a vulnerability allowing an attacker to bypass authentication and make administrator requests via a specially forged request.

The version of Palo Alto Networks PAN-OS running on the remote host is 10.2.x prior to 10.2.12-h2 or 11.0.x prior to 11.0.6-h1 or 11.1.x prior to 11.1.5-h1 or 11.2.x prior to 11.2.4-h1. It is, therefore, affected by multiple vulnerabilities.

    An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with     network access to the management web interface to gain PAN-OS administrator privileges to perform     administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation     vulnerabilities like [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474).

    The risk of this issue is greatly reduced if you secure access to the management web interface by     restricting access to only trusted internal IP addresses according to our recommended[best practice     deployment guidelines](https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-     the-management-access-of-your-palo/ba-p/464431).

    This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software on PA-     Series, VM-Series, and CN-Series firewalls and on Panorama (virtual and M-Series).

    Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Tenable has extracted the preceding description block directly from the PAN-OS security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114514	Palo Alto PAN-OS GlobalProtect Authentication Bypass	Web App Scanning	Component Vulnerability	medium
211512	Palo Alto Networks PAN-OS 10.2.x < 10.2.12-h2 / 11.0.x < 11.0.6-h1 / 11.1.x < 11.1.5-h1 / 11.2.x < 11.2.4-h1 Multiple Vulnerabilities	Nessus	Palo Alto Local Security Checks	medium

Detections

Analytics

CVE-2024-0012

medium

Tenable Plugins

Coming Soon

medium

medium