CVE-2024-0009

PAN-OS: Improper IP Address Verification in GlobalProtect Gateway

Severity
Medium 6.3
CVSS 3.1
Exploited
Not listed
EPSS
0.002
10.3th percentile
Discovered by
Customer
Vendor-published field
Published
Feb 14, 2024
Assigned by palo_alto

Description

An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a VPN connection from an unauthorized IP address.

Weakness: CWE-940

Affected products

Vendor Product Category Matched by
Palo Alto Networks PAN-OS Firewall / NGFW cna-assigner
Vendor-reported products (3)
  • Palo Alto Networks · PAN-OS
  • Palo Alto Networks · Prisma Access — vendor states not affected
  • Palo Alto Networks · Cloud NGFW — vendor states not affected

Credit

Palo Alto Networks thanks Matthew Fong for discovering and reporting this issue.

Vendor remediation

This issue is fixed in PAN-OS 10.2.4, PAN-OS 11.0.1, and all later PAN-OS versions.

Something wrong here?