CVE-2021-3060: PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)
An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root user privileges. The attacker must have network access to the GlobalProtect interfaces to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers with Prisma Access 2.1 Preferred and Prisma Access 2.1 Innovation firewalls are impacted by this issue.
Affected Software
Remediation
Information
Information
Event History
Frequently Asked Questions
What is CVE-2021-3060?
CVE-2021-3060 is an OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software that allows an unauthenticated attacker to execute arbitrary code with root user privileges.
How severe is CVE-2021-3060?
CVE-2021-3060 has a severity level of 8.1, which is considered critical.
Which software versions are affected by CVE-2021-3060?
Paloaltonetworks Prisma Access version 2.1, and Paloaltonetworks Pan-os versions 8.1.0 to 8.1.20, 9.0.0 to 9.0.14, 9.1.0 to 9.1.11, and 10.0.0 to 10.0.8 are affected by CVE-2021-3060.
How can I fix CVE-2021-3060?
To fix CVE-2021-3060, upgrade to a non-vulnerable version of Paloaltonetworks Prisma Access or Paloaltonetworks Pan-os software.
Where can I find more information about CVE-2021-3060?
You can find more information about CVE-2021-3060 on the Palo Alto Networks documentation and security websites.