CVE-2024-0012
9.8 CRITICAL
📋 TL;DR
An authentication bypass vulnerability in Palo Alto Networks PAN-OS software allows unauthenticated attackers with network access to the management web interface to gain administrator privileges. This affects PAN-OS 10.2, 11.0, 11.1, and 11.2 installations. Cloud NGFW and Prisma Access are not impacted.
💻 Affected Systems
Products:
- Palo Alto Networks PAN-OS
Versions: PAN-OS 10.2, 11.0, 11.1, 11.2
Operating Systems: PAN-OS specific
Default Config Vulnerable:
⚠️ Yes
Notes: Only affects management web interface. Cloud NGFW and Prisma Access are not vulnerable.
📦 What is this software?
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
Pan Os by Paloaltonetworks
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of firewall with administrative control, configuration tampering, data exfiltration, and lateral movement into protected networks.
Likely Case
Unauthorized administrative access leading to firewall rule manipulation, VPN configuration changes, and credential harvesting.
If Mitigated
Limited to internal network access only, significantly reducing attack surface.
🌐 Internet-Facing: HIGH - Unauthenticated remote code execution with CVSS 9.8 score indicates critical risk for internet-exposed interfaces.
🏢 Internal Only: MEDIUM - Still dangerous but requires internal network access, reducing external attack vectors.
🎯 Exploit Status
Public PoC:
⚠️ Yes
Weaponized:
CONFIRMED
Unauthenticated Exploit:
⚠️ Yes
Complexity:
LOW
CISA has added to Known Exploited Vulnerabilities catalog. Multiple public analysis and exploitation details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific fixed versions
Vendor Advisory: https://security.paloaltonetworks.com/CVE-2024-0012
Restart Required: Yes
Instructions:
1. Check current PAN-OS version. 2. Apply vendor-recommended patch for affected versions. 3. Restart firewall services. 4. Verify patch installation.
🔧 Temporary Workarounds
Restrict Management Interface Access
allLimit management web interface access to trusted internal IP addresses only
Configure firewall rules to restrict management interface access to specific IP ranges
🧯 If You Can't Patch
- Immediately restrict management interface to trusted internal IP addresses only
- Implement network segmentation to isolate management interfaces from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check PAN-OS version via web interface or CLI. If running 10.2, 11.0, 11.1, or 11.2, system is vulnerable.Check Version:
show system info | match versionVerify Fix Applied:
Verify PAN-OS version is updated to vendor-recommended patched version and test authentication requirements.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to management interface from unexpected sources
- Administrative actions from unauthenticated or unexpected user accounts
Network Indicators:
- Unusual traffic patterns to management interface ports
- Authentication bypass attempts
SIEM Query:
source="pan-firewall" (event_type="authentication" AND result="failure") OR (event_type="configuration" AND user="unknown")🔗 References
- https://security.paloaltonetworks.com/CVE-2024-0012
- https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/
- https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-0012
