CVE-2024-0012

The flaw lies in bypassing the authentication mechanism (CWE-306 — Missing Authentication for Critical Function) in the PAN-OS web management interface. An attacker with network access to this interface can obtain full administrator privileges without providing any credentials. Additionally, the vulnerability can be chained with CVE-2024-9474 — a privilege escalation flaw — enabling further privilege elevation in the system. Risk is significantly reduced if management interface access is restricted exclusively to trusted internal IP addresses in accordance with vendor guidelines.

An attacker can seize full administrative control over the device — perform administrative actions, modify firewall configuration, and exploit vulnerabilities requiring authentication (e.g., CVE-2024-9474) for further privilege escalation.

Apply patches available from the vendor immediately according to references (https://security.paloaltonetworks.com/CVE-2024-0012). As an immediate workaround, restrict access to the management web interface exclusively to trusted internal IP addresses in accordance with Palo Alto Networks secure deployment guidelines.

Palo Alto Networks PAN-OS in versions: 10.2, 11.0, 11.1, and 11.2. Cloud NGFW and Prisma Access products are not vulnerable.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.