CVE-2024-00129.3CriticalCWE-306

CVE-2024-0012: PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

Palo Alto Networks · Cloud NGFW

Vendor fix available · Affected: Palo Alto Networks Cloud NGFW · Exploitation: in CISA KEV since 18 Nov 2024

Known ransomware use

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

ExploitationIn CISA KEV

In CISA KEVCISA KEV catalogue18 Nov 2024
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public: not seen
Not established: not seen

99.8%probability of exploitation in the next 30 days

99th percentile

050100

Higher than 99% of scored CVEs

9.3CriticalCVSS 4.0

LowMediumHighCrit.

DescriptionCVE.org

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Affected products3

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Palo Alto Networks · Cloud NGFWVersions not stated
Palo Alto Networks · PAN-OSfrom 11.2.0 before 11.2.4-h1; from 11.1.0 before 11.1.5-h1; from 11.0.0 before 11.0.6-h1; from 10.2.0 before 10.2.12-h2
Palo Alto Networks · Prisma AccessVersions not stated

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.
CISA KEV: Listed since 18 Nov 2024 · known ransomware use · catalogue entry
Public check: PAN-OS Management Web Interface - Authentication Bypass · nuclei template in projectdiscovery/nuclei-templates
Weakness: Missing Authentication · Authentication
Vendor: Palo Alto Networks
Published: November 2024
Band: Exploited in the wild, November 2024

What changed

5 Nov
CISA’s KEV entry now notes known ransomware use CISA
18 Nov 2024
CISA added it to the KEV catalogue CISA

CoverageNo articles yet

No CyberSIXT article names CVE-2024-0012 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.