InfoSecBulletin Cybersecurity for mankind
“Palo Alto Networks has observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces which are exposed to the Internet. We are actively investigating this activity,” reads the security bulletin by the cybersecurity provider Palo Alto Networks.
On November 8, Palo Alto issued a security advisory about a zero-day vulnerability in certain PAN-OS firewall management interfaces. The vulnerability is an unauthenticated remote code execution (RCE) flaw in the internet management interfaces of next-generation firewalls (NGFWs) that are exposed online.
Hackers Bypass Gmail MFA With App-Specific Password Reuse
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
Paraguay 7.4 Million Citizen Records Leaked on Dark Web
High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation
SoftBank: Over 137,000 personal info leaked
CVSS Score of 9.3:
Palo Alto considers it a critical vulnerability with a CVSS score of 9.3. The vulnerability only impacts public-facing management interfaces of NGFWs. The manufacturer asserts that Prisma Access and Cloud NGFW are not affected.
“If the management interface access is restricted to IPs, the risk of exploitation is greatly limited, as any potential attack would first require privileged access to those IPs. CVSS for this scenario is 7.5 High,” added the company.
Palo Alto initially reported no threat related to the new vulnerability, but updated its advisory on November 14 to confirm it has been exploited in the wild.
Palo Alto Working on a Patch:
Palo Alto notified customers that it is working on updates to protect against threats, which will be available soon.
“We strongly recommend customers to ensure access to your management interface is configured correctly in accordance with our recommended best practice deployment guidelines,” Palo Alto added in its advisory.
This comes only days after the US Cybersecurity and Infrastructure Security Agency (CISA) added another vulnerability affecting a Palo Alto product – this time Palo Alto Expedition (CVE-2024-5910) – to its Known Exploited Vulnerability (KEV) catalog.
