CVE-2024-3400
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
At a glance Severity CRITICAL 10.0 Exploitation Known exploited (CISA KEV) · added 2024-04-12 Exploited per ENISA since 2024-04-12 EPSS EPSS 100.00 % · percentile 100 (2026-10-27) State PUBLISHED Published 2024-04-12 Updated 2025-10-21 Assigner palo_alto NVD status Analyzed Description A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.
Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
Scores Version Score Vector Scored by CVSS 3.1 CRITICAL 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H palo_alto CVSS 3.1 CRITICAL 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H NVD · psirt@paloaltonetworks.com (Secondary) CVSS 3.1 CRITICAL 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h11:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h12:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h9:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h10:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h3:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h3:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h2:*:*:*:*:*:*+12 more Affected products
References
Sources
