Critical Zero-Day Vulnerabilities Discovered in Palo Alto Networks PAN-OS

Critical Zero-Day Vulnerabilities Discovered in Palo Alto Networks PAN-OS

Martin Kouyoumdjian |

Understanding the Vulnerabilities

Zero-Day Vulnerabilities Discovered

Palo Alto Networks recently confirmed the presence of two critical zero-day vulnerabilities within their PAN-OS firewall management interface. Reported under CVE-2024-0012 and CVE-2024-9474, these vulnerabilities are actively being exploited by attackers targeting PAN-OS devices.

Details of the Exploits

CVE-2024-0012 manifests as an authentication bypass vulnerability, allowing remote, unauthenticated attackers to gain administrative privileges over the system. With an alarming CVSS score of 9.3, it poses a significant threat. Meanwhile, CVE-2024-9474 is a privilege escalation vulnerability enabling authenticated users to escalate their privileges to root level. This vulnerability holds a CVSS score of 6.9, making it considerably dangerous as well.

Impact on Systems and Mitigation Strategies

Wide Reach and Exploitation

The flaws impact a range of PAN-OS versions, such as 10.2, 11.0, 11.1, and 11.2. However, it's important to note that Cloud NGFW and Prisma Access remain unaffected. Attackers have been exploiting these vulnerabilities in campaigns like Operation Lunar Peek, particularly arising from IPs linked to anonymous VPN services.

Mitigating Risks

To reduce exposure, administrators are advised to restrict access to the management interface solely to trusted internal IPs. This can be further reinforced by isolating the interface on a dedicated VLAN or employing jump servers with separate authentication layers. Prompt updates to patched versions of PAN-OS can also prevent exploitation.

The Global Cybersecurity Implications

Ongoing Threats and Exploit Chains

These vulnerabilities enable attackers to execute malicious code at the highest privilege levels, posing risks like installing web shells and manipulating network traffic. Widely exploited, over 2,000 firewalls have been compromised, with nearly 2,700 additional devices remaining vulnerable.

Regulatory Interventions

In response to the growing threat, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to patch these vulnerabilities by December 9, 2024. This regulatory push underscores the urgency and the need for proactive vulnerability management as similar threats have been observed in devices from other major vendors like Cisco and Fortinet.