CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

[V.Benfanti]

Hello!
I just received and was reading this email CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface and if I'm reading it right, the guidance is to upgrade to 10.2.12-h2 or greater (I'm on a PA-220, 11 is not supported). I've been trying to stick with the Preferred versions here Support PAN-OS Software Release Guidance and the latest Preferred version is 10.2.10-h7 which I believe is vulnerable. Do I have that right???  Thanks!

[SeSchulte · Accepted solution]

Hello V. Benfanti,

On the one hand, you have to stay in the 10.2 tree with the PA-220, as this is the last version that supports the hardware platform.
Furthermore, the bug in 10.2.10-h7 is not yet fixed and you would have to switch to a fixed version at this point, in this case 10.2.12-h2.
Alternatively, please check whether you have followed the best practice regarding the protection of MGMT interfaces.
See here: https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-ac...
As you can reduce the CVE to a 5.9.

Furthermore, please check if you have installed the Conntent version 8915-9075, so that the attacks can be recognized by the firewall (Threat IDs 95746, 95747, 95752, 95753, 95759, and 95763).

Best regards

[Ecaballero]

IS Pan OS 9.1 vulnerable?  The advisory does not state. 

[BPry]

@Ecaballero,

It seems likely that it is since this covers all presently supported versions of PAN-OS. Since 9.1 is EoL and the PA-3000 series also went EoL here a couple of weeks ago there's zero support for that build anymore. I'd highly recommend that you secure the management port and  getting that equipment replaced.

[iarobertson]

Hello @Ecaballero - PanOS 9.1 is not vulnerable to this issue. However it is strongly advised to move off 9.1 as this is no longer a supported release.