What happened
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM). The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
Affected versions
Cloud NGFW: 12.2.0 through before 12.2.3 (custom); 12.1.0 through before 12.1.4-h10 (custom); 11.2.0 through before 11.2.4-h21 (custom); 11.1.0 through before 11.1.4-h36 (custom); 10.2.0 through before 10.2.7-h37 (custom) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
No public PoC reference has passed the current publication threshold.