Threat Investigation
Request a demo

CVE-2020-2029

High

Description

An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root privileges by sending a malicious request to generate new certificates for use in the PAN-OS configuration. This issue affects: All versions of PAN-OS 8.0; PAN-OS 7.1 versions earlier than PAN-OS 7.1.26; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13.

SeverityHigh
CVSS7.2
Exploit probability—
ProductPaloaltonetworks Pan-os
PublishedJun 10, 2020
First seenJun 10, 2020
Weakness typeCWE-78OS command injection

How to fix

Update
  • paloaltonetworks pan-os7.1.26, 8.1.13 or later

Affected products

ProductAffected versionsFixed in
paloaltonetworks pan-os7.1.0 ≤ v < 7.1.26, 8.0.0 ≤ v ≤ 8.0.20, 8.1.0 ≤ v < 8.1.137.1.26, 8.1.13

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.