Critical RCE Vulnerability in Palo Alto Networks’ GlobalProtect

Kyaw_Myo_Oo — Wed, 17 Apr 2024 04:25:16 GMT

Dear All,

Palo Alto Networks has released hotfixes to address a critical command injection vulnerability in multiple versions of their PAN-OS software. Palo Alto Networks was alerted to the vulnerability by researchers from Volexity. The flaw is being actively exploited to place Python backdoors on vulnerable devices. According to Palo Alto Networks, the flaw affects “PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 firewalls configured with GlobalProtect gateway or GlobalProtect portal (or both) and device telemetry enabled.”

https://security.paloaltonetworks.com/CVE-2024-3400?is=2e17210a000df3b23714ee0b7fabf90d53a139a7fd871f741a8f77fe7ad94a1a

https://www.bleepingcomputer.com/news/security/exploit-released-for-palo-alto-pan-os-bug-used-in-attacks-patch-now/?traffic_source=Connatix

https://www.cisa.gov/news-events/alerts/2024/04/12/cisa-adds-one-known-exploited-vulnerability-catalog

Re: Critical RCE Vulnerability in Palo Alto Networks’ GlobalProtect

Early_Adopter — Wed, 17 Apr 2024 16:13:49 GMT

That’s about as bad as it gets.

Are *you* running Global Protect, or sending telemetry to PAN?

topic Re: Critical RCE Vulnerability in Palo Alto Networks’ GlobalProtect in Threats

Critical RCE Vulnerability in Palo Alto Networks’ GlobalProtect

Re: Critical RCE Vulnerability in Palo Alto Networks’ GlobalProtect