CyberCVE

CVE-2024-3387

PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information Disclosure

Severity
Medium 5.3
CVSS 3.1
Exploited
Not listed
EPSS
0.002
6.7th percentile
Discovered by
Customer
Published by the vendor
Published
Apr 10, 2024
Assigned by palo_alto

Description

A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sensitive information that is shared between the management server and the firewalls.

Weakness: CWE-326

Affected products

Vendor Product Category Matched by
Palo Alto Networks Cloud NGFW Firewall / NGFW cna-assigner
Palo Alto Networks PAN-OS Firewall / NGFW cna-assigner
Palo Alto Networks Prisma Access SASE / SSE / Secure Web cna-assigner
Vendor-reported affected versions (6)
  • Palo Alto Networks · PAN-OS
  • Palo Alto Networks · Cloud NGFW
  • Palo Alto Networks · Prisma Access
  • paloaltonetworks · pan-os
  • paloaltonetworks · pan-os
  • paloaltonetworks · pan-os

Credit

Palo Alto Networks thanks one of our customers for discovering and reporting this issue.

Vendor remediation

This issue is fixed in PAN-OS 10.1.12, PAN-OS 10.2.7-h3, PAN-OS 10.2.8, PAN-OS 11.0.4, and all later PAN-OS versions.

References