CVE-2024-9469 Cortex XDR Agent: Local Windows User Can Disable the Agent
Description
A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Cortex XDR Agent 8.6 | None | All |
| Cortex XDR Agent 8.5 | None | All |
| Cortex XDR Agent 8.4 | < 8.4.1 on Windows | >= 8.4.1 on Windows |
| Cortex XDR Agent 8.3-CE | None | All |
| Cortex XDR Agent 8.3 | < 8.3.1 on Windows | >= 8.3.1 on Windows |
| Cortex XDR Agent 7.9-CE | < 7.9.102-CE on Windows | >= 7.9.102-CE on Windows |
Severity: MEDIUM
CVSSv4.0 Base Score: 5.7 (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type
CWE-754: Improper Check for Unusual or Exceptional Conditions
Solution
This issue is fixed in Cortex XDR Agent 7.9.102-CE, Cortex XDR Agent 8.3.1, Cortex XDR Agent 8.4.1, and all later Cortex XDR Agent versions.
Acknowledgments
CPEs
cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:8.4.0:-:*:*:*:*:*:*
cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:8.3.0:-:*:*:*:*:*:*
cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.9-CE:-:*:*:*:*:*:*
cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.9.101-CE:-:*:*:*:*:*:*