Palo Alto Networks confirmed two zero-day vulnerabilities were exploited as part of attacks in the wild against PAN-OS devices, with one being attributed to Operation Lunar Peek.

CVE-2024-0012, CVE-2024-9474: Zero-Day Vulnerabilities in Palo Alto PAN-OS Exploited In The Wild

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.14-h6 or 10.2.x prior to 10.2.12-h2 or 11.0.x prior to 11.0.6-h1 or 11.1.x prior to 11.1.5-h1 or 11.2.x prior to 11.2.4-h1. It is, therefore, affected by a vulnerability.

    A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator     with access to the management web interface to perform actions on the firewall with root privileges.

    This issue is applicable to PAN-OS 10.1, PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software     on PA-Series, VM-Series, and CN-Series firewalls and on Panorama (virtual and M-Series)and WildFire     appliances.

    Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Tenable has extracted the preceding description block directly from the PAN-OS security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Palo Alto Networks PAN-OS running on the remote host is 10.2.x prior to 10.2.12-h2 or 11.0.x prior to 11.0.6-h1 or 11.1.x prior to 11.1.5-h1 or 11.2.x prior to 11.2.4-h1. It is, therefore, affected by multiple vulnerabilities.

    An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with     network access to the management web interface to gain PAN-OS administrator privileges to perform     administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation     vulnerabilities like [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474).

    The risk of this issue is greatly reduced if you secure access to the management web interface by     restricting access to only trusted internal IP addresses according to our recommended[best practice     deployment guidelines](https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-     the-management-access-of-your-palo/ba-p/464431).

    This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software on PA-     Series, VM-Series, and CN-Series firewalls and on Panorama (virtual and M-Series).

    Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Tenable has extracted the preceding description block directly from the PAN-OS security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211513	Palo Alto Networks PAN-OS 10.1.x < 10.1.14-h6 / 10.2.x < 10.2.12-h2 / 11.0.x < 11.0.6-h1 / 11.1.x < 11.1.5-h1 / 11.2.x < 11.2.4-h1 Vulnerability	Nessus	Palo Alto Local Security Checks	medium
211512	Palo Alto Networks PAN-OS 10.2.x < 10.2.12-h2 / 11.0.x < 11.0.6-h1 / 11.1.x < 11.1.5-h1 / 11.2.x < 11.2.4-h1 Multiple Vulnerabilities	Nessus	Palo Alto Local Security Checks	medium

Detections

Analytics

CVE-2024-9474

medium

Tenable Plugins

medium

medium