CVE-2022-0024
Description
A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committed on both hardware and virtual firewalls. This issue does not impact Panorama appliances or Prisma Access customers. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.23; PAN-OS 9.0 versions earlier than PAN-OS 9.0.16; PAN-OS 9.1 versions earlier than PAN-OS 9.1.13; PAN-OS 10.0 versions earlier than PAN-OS 10.0.10; PAN-OS 10.1 versions earlier than PAN-OS 10.1.5.
How to fix
- paloaltonetworks pan-os8.1.23, 9.0.16, 9.1.13, 10.0.10, 10.1.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| paloaltonetworks pan-os | 8.1.0 ≤ v < 8.1.23, 9.0.0 ≤ v < 9.0.16, 9.1.0 ≤ v < 9.1.13, 10.0.0 ≤ v < 10.0.10, 10.1.0 ≤ v < 10.1.5 | 8.1.23, 9.0.16, 9.1.13, 10.0.10, 10.1.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.