InfoSecBulletin Cybersecurity for mankind
“Palo Alto Networks has observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces which are exposed to the Internet. We are actively investigating this activity,” reads the security bulletin by the cybersecurity provider Palo Alto Networks.
On November 8, Palo Alto issued a security advisory about a zero-day vulnerability in certain PAN-OS firewall management interfaces. The vulnerability is an unauthenticated remote code execution (RCE) flaw in the internet management interfaces of next-generation firewalls (NGFWs) that are exposed online.
Workshop on “DDoS use cases & solutions for government & BFSI” held at BCS
Uganda confirms hack of central bank accounts, Refutes $17 Million Claim
CVE-2024-11667
Hackers actively exploiting Zyxel firewall to deploy Ransomware
Daily Security Update Dated: 29.11.2024
CIRT-in flags Critical Flaw in Oracle Agile PLM Framework
Microsoft patches four vulnerabilities in its services
Data broker exposes 600K+ passwordless sensitive files online
Cloudflare logs faces major failure, losing 55% of user data
VMware Patched critical flaw in Aria Operations
HDFC Life hit by data breach, begins investigation
CVSS Score of 9.3:
Palo Alto considers it a critical vulnerability with a CVSS score of 9.3. The vulnerability only impacts public-facing management interfaces of NGFWs. The manufacturer asserts that Prisma Access and Cloud NGFW are not affected.
“If the management interface access is restricted to IPs, the risk of exploitation is greatly limited, as any potential attack would first require privileged access to those IPs. CVSS for this scenario is 7.5 High,” added the company.
Palo Alto initially reported no threat related to the new vulnerability, but updated its advisory on November 14 to confirm it has been exploited in the wild.
Palo Alto Working on a Patch:
Palo Alto notified customers that it is working on updates to protect against threats, which will be available soon.
“We strongly recommend customers to ensure access to your management interface is configured correctly in accordance with our recommended best practice deployment guidelines,” Palo Alto added in its advisory.
This comes only days after the US Cybersecurity and Infrastructure Security Agency (CISA) added another vulnerability affecting a Palo Alto product – this time Palo Alto Expedition (CVE-2024-5910) – to its Known Exploited Vulnerability (KEV) catalog.
