CVE-2024-2552: PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI) (Severity: MEDIUM)
First published: Wed Nov 13 2024(Updated: )
A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall.
Credit: psirt@paloaltonetworks.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Palo Alto Networks Cloud NGFW | ||
| Palo Alto Networks PAN-OS | <11.2.4=11.2.0<11.1.5=11.1.0<11.0.6=11.0.0<10.2.12=10.2.0 | 11.2.4 11.1.5 11.1.4-h9 11.0.6 10.2.12 10.2.9-h18 10.2.8-h18 10.2.10-h10 10.2.11-h9 |
| Palo Alto Networks Prisma Access |
Remedy
We strongly recommend customers to ensure access to your management interface is configured correctly in accordance with our recommended best practice deployment guidelines. In particular, we recommend that you ensure that access to the management interface is possible only from trusted internal IPs and not from the Internet. The vast majority of firewalls already follow this Palo Alto Networks and industry best practice. Please see the following link for additional information regarding how to secure the management access of your palo alto networks device: https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431
Remedy
This issue is fixed in PAN-OS 10.2.12, PAN-OS 11.0.6, PAN-OS 11.1.5, PAN-OS 11.2.4, and all later PAN-OS versions. In addition, in an attempt to provide the most seamless upgrade path for our customers, we are making additional fixes available as noted below: * Additional 11.1 fix: * 11.1.4-h9 * Additional 10.2 fixes: * 10.2.11-h9 * 10.2.10-h10 * 10.2.9-h18 * 10.2.8-h18
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- agent/weakness
- agent/references
- agent/type
- agent/author
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- collector/paloaltonetworks-latest
- source/Palo Alto Networks
- agent/title
- agent/first-publish-date
- agent/severity
- agent/event
- agent/remedy
- agent/tags
- agent/description
- collector/paloaltonetworks-api
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/trending
- vendor/palo alto networks
- canonical/palo alto networks cloud ngfw
- canonical/palo alto networks pan-os
- version/palo alto networks pan-os/11.2.0
- version/palo alto networks pan-os/11.1.0
- version/palo alto networks pan-os/11.0.0
- version/palo alto networks pan-os/10.2.0
- canonical/palo alto networks prisma access