Palo Alto Networks is warning {that a} crucial flaw impacting PAN-OS software program utilized in its GlobalProtect gateways is being actively exploited within the wild.
Tracked as CVE-2024-3400, the problem has a CVSS rating of 10.0, indicating most severity.
“A command injection vulnerability within the GlobalProtect function of Palo Alto Networks PAN-OS software program for particular PAN-OS variations and distinct function configurations could allow an unauthenticated attacker to execute arbitrary code with root privileges on the firewall,” the corporate mentioned in an advisory printed immediately.
The flaw impacts the next variations of PAN-OS, with fixes anticipated to be launched on April 14, 2024 –
- PAN-OS < 11.1.2-h3
- PAN-OS < 11.0.4-h1
- PAN-OS < 10.2.9-h1
The corporate additionally mentioned that the problem is relevant solely to firewalls which have the configurations for each GlobalProtect gateway (Community > GlobalProtect > Gateways) and gadget telemetry (Gadget > Setup > Telemetry) enabled.
Menace intelligence and incident response firm Volexity has been credited with discovering and reporting the bug.
Whereas there aren’t any different ttechnical particulars concerning the nature of the intrusions or the identification of risk actors behind them, Palo Alto Networks acknowledged that it is “conscious of a restricted variety of assaults that leverage the exploitation of this vulnerability.”
Within the interim, it is recommending prospects with a Menace Prevention subscription to allow Menace ID 95187 to safe towards the risk.
The event comes as Chinese language risk actors have more and more relied on zero-day flaws impacting Barracuda Networks, Fortinet, Ivanti, and VMware to breach targets of curiosity and deploy covert backdoors for persistent entry.
