CVE-2024-3400PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 10.0 | CRITICAL | 3.1palo_alto (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Apr 19, 2024
Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
Details
- CVE ID
- CVE-2024-3400
- Status
- Analyzed
- Assigner (CNA)
- palo_alto
- Published
- Apr 12, 2024
- Last modified
- 2026-06-17 07:44 UTC
Affected Products
As published by the CNA in the CVE record.
Palo Alto NetworksPAN-OS3 version ranges
- 10.2.0 before 10.2.9-h1
- 11.0.0 before 11.0.4-h1
- 11.1.0 before 11.1.2-h3
Palo Alto NetworksCloud NGFW0 version ranges
No version detail published.
Palo Alto NetworksPrisma Access0 version ranges
No version detail published.
References
- security.paloaltonetworks.com https://security.paloaltonetworks.com/CVE-2024-3400
- unit42.paloaltonetworks.com https://unit42.paloaltonetworks.com/cve-2024-3400/
- paloaltonetworks.com https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/
- volexity.com https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400