CVE-2024-9474

Katalog CVE

CVSS 7.2 · High KEV · sudah dieksploitasi Dipakai ransomware EPSS 94,8%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada paloaltonetworks pan-os. Skor CVSS 3.1 7.2 (High) menurut NVD. Masuk katalog KEV CISA pada 18 November 2024, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Rincian

Terbit di NVD

18 November 2024

Terakhir diubah

4 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

94,8% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

Masuk KEV

18 November 2024

Tenggat CISA

9 Desember 2024 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.paloaltonetworks.com/CVE-2024-9474 advisory vendor
• https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/ press/media coverage · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9474 pemerintah AS
• https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/ exploit · advisory pihak ketiga
• https://github.com/k4nfr3/CVE-2024-9474 exploit