CVE-2024-8686 PAN-OS: Command Injection Vulnerability
Response Effort
MODERATE
Recovery
USER
Value Density
CONCENTRATED
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Automatable
NO
User Interaction
NONE
Product Confidentiality
HIGH
Product Integrity
HIGH
Product Availability
HIGH
Privileges Required
HIGH
Subsequent Confidentiality
NONE
Subsequent Integrity
NONE
Subsequent Availability
NONE
Description
A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as root on the firewall.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Cloud NGFW | None | All |
| PAN-OS 11.2 | 11.2.2 | >= 11.2.3 |
| PAN-OS 11.1 | None | All |
| PAN-OS 11.0 | None | All |
| PAN-OS 10.2 | None | All |
| PAN-OS 10.1 | None | All |
| Prisma Access | None | All |
Severity: HIGH
CVSSv4.0 Base Score: 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Solution
This issue is fixed in PAN-OS 11.2.3 and all later PAN-OS versions.
Acknowledgments
Palo Alto Networks thanks Louis Lingg for discovering and reporting this issue.
Timeline
Initial publication