The vulnerability in the web interface for managing Ethernet switches of Palo Alto Networks, which is controlled by the PAN-OS operating system, allows a hacker to elevate their privileges to the root user level.

🗓️ 20 Nov 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Web interface in Palo Alto Networks switches enables root privilege escalation via unfiltered commands.

Reporter	Title	Published	Views	Family All 60
GithubExploit	Exploit for Missing Authentication for Critical Function in Paloaltonetworks Pan-Os	11 Dec 202418:13	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Paloaltonetworks Pan-Os	19 Nov 202417:26	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Paloaltonetworks Pan-Os	21 May 202503:59	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Paloaltonetworks Pan-Os	16 Jan 202520:07	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Paloaltonetworks Pan-Os	20 Nov 202422:31	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Paloaltonetworks Pan-Os	22 Nov 202414:11	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Paloaltonetworks Pan-Os	19 Nov 202408:29	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Paloaltonetworks Pan-Os	6 Feb 202520:30	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Paloaltonetworks Pan-Os	19 Nov 202411:30	–	githubexploit
ATTACKERKB	CVE-2024-9474	18 Nov 202400:00	–	attackerkb

Vulners

Node

palo_alto_networks pan-osRange<11.2.4-h1

OR

palo_alto_networks pan-osRange<11.1.5-h1

OR

palo_alto_networks pan-osRange<11.0.6-h1

OR

palo_alto_networks pan-osRange<10.2.12-h2

OR

palo_alto_networks pan-osRange<10.1.14-h6

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-9474
security	www.security.paloaltonetworks.com/CVE-2024-9474
vuldb	www.vuldb.com/
labs	www.labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/
web	www.web.nvd.nist.gov/view/vuln/detail

27 Dec 2024 00:00Current

7.8High risk

Vulners AI Score7.8

CVSS 37.2

CVSS 29

EPSS0.94766

Palo Alto Networks Web interface Switch management Root privileges Unfiltered commands