InfoSecBulletin Cybersecurity for mankind
“Palo Alto Networks has observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces which are exposed to the Internet. We are actively investigating this activity,” reads the security bulletin by the cybersecurity provider Palo Alto Networks.
On November 8, Palo Alto issued a security advisory about a zero-day vulnerability in certain PAN-OS firewall management interfaces. The vulnerability is an unauthenticated remote code execution (RCE) flaw in the internet management interfaces of next-generation firewalls (NGFWs) that are exposed online.
CYDES 2025 Reinforces Malaysia’s Vision of Secure and Trusted Digital Nation
Cisco alerts that Unified CM has hardcoded root SSH credentials
CYDES 2025
MCSS to implement 6 strategic goals with 7 objectives over 6 year: NACSA Chief
CYDES 2025
Malaysia placed cybersecurity heart of the regional agenda: DPM Ahmad Zahid
Amid Meta moves; OpenAI is largely shutting down next week: Wired
Canada orders Hikvision to close operations over national security
First couple “Rosie” to conceive using AI tech “STAR” successfully
Scattered Spider Actively Attacking Aviation and Transportation: FBI
Russia’s restrictions on Cloudflare making websites inaccessible
61 million Verizon records allegedly posted online for sale
CVSS Score of 9.3:
Palo Alto considers it a critical vulnerability with a CVSS score of 9.3. The vulnerability only impacts public-facing management interfaces of NGFWs. The manufacturer asserts that Prisma Access and Cloud NGFW are not affected.
“If the management interface access is restricted to IPs, the risk of exploitation is greatly limited, as any potential attack would first require privileged access to those IPs. CVSS for this scenario is 7.5 High,” added the company.
Palo Alto initially reported no threat related to the new vulnerability, but updated its advisory on November 14 to confirm it has been exploited in the wild.
Palo Alto Working on a Patch:
Palo Alto notified customers that it is working on updates to protect against threats, which will be available soon.
“We strongly recommend customers to ensure access to your management interface is configured correctly in accordance with our recommended best practice deployment guidelines,” Palo Alto added in its advisory.
This comes only days after the US Cybersecurity and Infrastructure Security Agency (CISA) added another vulnerability affecting a Palo Alto product – this time Palo Alto Expedition (CVE-2024-5910) – to its Known Exploited Vulnerability (KEV) catalog.
