InfoSecBulletin Cybersecurity for mankind
“Palo Alto Networks has observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces which are exposed to the Internet. We are actively investigating this activity,” reads the security bulletin by the cybersecurity provider Palo Alto Networks.
On November 8, Palo Alto issued a security advisory about a zero-day vulnerability in certain PAN-OS firewall management interfaces. The vulnerability is an unauthenticated remote code execution (RCE) flaw in the internet management interfaces of next-generation firewalls (NGFWs) that are exposed online.
Eight New ICS Advisories released by CISA
Authority Denies
Hacker claim ransomware attack on Indonesia’s state bank BRI
London-based company “Builder.ai” reportedly exposed 1.2 TB data
(CVE-2024-12727, CVE-2024-12728, CVE-2024-12729)
Sophos resolved 3 critical vulnerabilities in Firewall
“Workshop on Cybersecurity Awareness and Needs Analysis” held at BBTA
CVE-2023-48788
Kaspersky reveals active exploitation of Fortinet Vulnerability
U.S. Weighs Ban on Chinese-Made Router TP-Link: WSJ reports
Daily Security Update Dated: 18.12.2024
CISA released best practices to secure Microsoft 365 Cloud environments
Data breach! Ireland fines Meta $264 million, Australia $50m
CVSS Score of 9.3:
Palo Alto considers it a critical vulnerability with a CVSS score of 9.3. The vulnerability only impacts public-facing management interfaces of NGFWs. The manufacturer asserts that Prisma Access and Cloud NGFW are not affected.
“If the management interface access is restricted to IPs, the risk of exploitation is greatly limited, as any potential attack would first require privileged access to those IPs. CVSS for this scenario is 7.5 High,” added the company.
Palo Alto initially reported no threat related to the new vulnerability, but updated its advisory on November 14 to confirm it has been exploited in the wild.
Palo Alto Working on a Patch:
Palo Alto notified customers that it is working on updates to protect against threats, which will be available soon.
“We strongly recommend customers to ensure access to your management interface is configured correctly in accordance with our recommended best practice deployment guidelines,” Palo Alto added in its advisory.
This comes only days after the US Cybersecurity and Infrastructure Security Agency (CISA) added another vulnerability affecting a Palo Alto product – this time Palo Alto Expedition (CVE-2024-5910) – to its Known Exploited Vulnerability (KEV) catalog.
