CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

L1 Bithead

Hello!
I just received and was reading this email CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface and if I'm reading it right, the guidance is to upgrade to 10.2.12-h2 or greater (I'm on a PA-220, 11 is not supported). I've been trying to stick with the Preferred versions here Support PAN-OS Software Release Guidance and the latest Preferred version is 10.2.10-h7 which I believe is vulnerable. Do I have that right???  Thanks!

VBenfanti_0-1731943900461.png

 

1 accepted solution

Accepted Solutions

L1 Bithead

Hello V. Benfanti,

On the one hand, you have to stay in the 10.2 tree with the PA-220, as this is the last version that supports the hardware platform.
Furthermore, the bug in 10.2.10-h7 is not yet fixed and you would have to switch to a fixed version at this point, in this case 10.2.12-h2.
Alternatively, please check whether you have followed the best practice regarding the protection of MGMT interfaces.
See here: https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-ac...
As you can reduce the CVE to a 5.9.

Furthermore, please check if you have installed the Conntent version 8915-9075, so that the attacks can be recognized by the firewall (Threat IDs 95746, 95747, 95752, 95753, 95759, and 95763).

Best regards

View solution in original post

4 REPLIES 4

L1 Bithead

Hello V. Benfanti,

On the one hand, you have to stay in the 10.2 tree with the PA-220, as this is the last version that supports the hardware platform.
Furthermore, the bug in 10.2.10-h7 is not yet fixed and you would have to switch to a fixed version at this point, in this case 10.2.12-h2.
Alternatively, please check whether you have followed the best practice regarding the protection of MGMT interfaces.
See here: https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-ac...
As you can reduce the CVE to a 5.9.

Furthermore, please check if you have installed the Conntent version 8915-9075, so that the attacks can be recognized by the firewall (Threat IDs 95746, 95747, 95752, 95753, 95759, and 95763).

Best regards

L0 Member

IS Pan OS 9.1 vulnerable?  The advisory does not state. 

Cyber Elite
Cyber Elite

@Ecaballero,

It seems likely that it is since this covers all presently supported versions of PAN-OS. Since 9.1 is EoL and the PA-3000 series also went EoL here a couple of weeks ago there's zero support for that build anymore. I'd highly recommend that you secure the management port and  getting that equipment replaced.

Hello @Ecaballero - PanOS 9.1 is not vulnerable to this issue. However it is strongly advised to move off 9.1 as this is no longer a supported release. 

Iain Robertson
Senior Customer Success Engineer, NGFW, Palo Alto Networks
  • 1 accepted solution
  • 1886 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!