CVE-2024-0012
Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
Description
CVE-2024-0012 is a critical authentication bypass vulnerability in Palo Alto Networks PAN-OS software that enables an unauthenticated attacker with network access to the management web interface to gain full PAN-OS administrator privileges. With a CVSS v3.1 base score of 9.8, the attacker can perform administrative actions, tamper with firewall configuration, or exploit other authenticated privilege escalation vulnerabilities such as CVE-2024-9474. The vulnerability affects PAN-OS versions across the 10.2, 11.0, 11.1, and 11.2 branches. CISA has added CVE-2024-0012 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 9, 2024, with a confirmed ransomware association. Its EPSS score of 94.29% at the 99.9th percentile confirms near-certain active exploitation across the threat landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | pan-os | 10.2.0; 10.2.1; 10.2.2; 10.2.3; 10.2.4; 10.2.5; 10.2.6; 10.2.7; 10.2.8; 10.2.9; 10.2.10; 10.2.11; 10.2.12; 11.0.0; 11.0.1; 11.0.2; 11.0.3; 11.0.4; 11.0.5; 11.0.6; 11.1.0; 11.1.1; 11.1.2; 11.1.3; 11.1.4; 11.1.5; 11.2.0; 11.2.1; 11.2.2; 11.2.3; 11.2.4 |
References
- https://security.paloaltonetworks.com/CVE-2024-0012(Vendor Advisory)
- https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/(Vendor Advisory)
- https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-0012(US Government Resource)
Weakness Type
Authentication Bypass in PAN-OS Management Web Interface
CVE-2024-0012 is an authentication bypass vulnerability in the Palo Alto Networks PAN-OS management web interface. The weakness allows an unauthenticated attacker to circumvent the authentication mechanisms protecting the firewall's administrative interface. Under normal circumstances, the PAN-OS management web interface requires valid administrator credentials before granting access to any management functionality. This vulnerability breaks that fundamental security control, enabling an attacker to gain full administrator-level access without providing any credentials. Authentication bypass vulnerabilities in network security appliances are among the most dangerous classes of vulnerabilities because they eliminate the primary barrier protecting the device's management plane.
Impact Analysis
The impact of CVE-2024-0012 is catastrophic, achieving the maximum CVSS impact ratings across all dimensions. Confidentiality is fully compromised because unauthenticated administrator access exposes all firewall configuration data, security policies, VPN configurations, SSL/TLS decryption keys, user authentication databases, and any other sensitive information managed by the PAN-OS device. The attacker can read the complete device configuration, export credentials, and access decryption capabilities.
Integrity faces maximum impact because administrator-level access allows the attacker to modify any aspect of the firewall configuration. This includes altering security policies to permit malicious traffic, creating new administrator accounts for persistent access, modifying logging settings to conceal their activity, and installing unauthorized software or configurations. When chained with CVE-2024-9474, the attacker can achieve root OS access, enabling even deeper modifications.
Availability is completely at risk as the attacker can disable the firewall, corrupt its configuration, lock out legitimate administrators, or render the device inoperable. The confirmed ransomware association means this vulnerability has been directly used in attack chains leading to ransomware deployment. The combination of unauthenticated access (PR:N), network reachability (AV:N), low complexity (AC:L), and no user interaction (UI:N) makes this vulnerability trivially exploitable, which is reflected in the near-maximum EPSS score of 94.29% at the 99.9th percentile.
Exploit Maturity
CVE-2024-0012 has reached maximum exploit maturity with confirmed active exploitation, public exploits, and a direct ransomware association. CISA has included it in the Known Exploited Vulnerabilities catalog with an urgent remediation deadline of December 9, 2024. The EPSS score of 94.29% at the 99.9th percentile places it among the most actively exploited vulnerabilities in existence.
Detailed technical exploitation analysis has been published by watchTowr Labs, providing a thorough walkthrough of the authentication bypass mechanism and its chaining with CVE-2024-9474 for root access. Palo Alto Networks' Unit 42 team has documented active exploitation campaigns at unit42.paloaltonetworks.com, confirming that threat actors are actively scanning for and exploiting exposed PAN-OS management interfaces. The confirmed ransomware classification by CISA means this vulnerability is being used as an initial access vector in ransomware attack chains, making immediate remediation essential for all organizations with internet-exposed PAN-OS management interfaces.
Remediation
-
Upgrade PAN-OS to a patched version immediately. Apply the security updates specified in Palo Alto Networks' advisory at CVE-2024-0012. Patched versions include PAN-OS 10.2.12-h2, 11.0.6-h1, 11.1.5-h1, 11.2.4-h1, and subsequent releases on each branch.
-
Block all external access to management interfaces. This is the most critical immediate mitigation. Ensure the PAN-OS management web interface is not accessible from the internet under any circumstances. Apply strict firewall rules to limit management interface access to a dedicated out-of-band management network. This single control prevents the most dangerous attack scenario where unauthenticated internet-based attackers exploit this vulnerability.
-
Assume compromise if management was exposed. Any PAN-OS device that had its management interface accessible from untrusted networks while running a vulnerable version must be treated as compromised. Perform a complete forensic analysis of device logs, configuration history, and network traffic. Look for unauthorized administrator accounts, configuration changes, and unexpected outbound connections.
-
Rotate all credentials and rebuild trust. After patching, change all PAN-OS administrator passwords, regenerate all SSL/TLS certificates, rotate VPN pre-shared keys and LDAP service account credentials, and revoke all API keys. If the device was used for SSL decryption, consider all inspected traffic as potentially exposed.
-
Patch CVE-2024-9474 simultaneously. CVE-2024-0012 is commonly chained with CVE-2024-9474 (privilege escalation to root). Both vulnerabilities must be patched together using the same PAN-OS update to close the complete attack chain from unauthenticated access to root-level compromise.
Technical Details
CVE-2024-0012 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, resulting in a critical base score of 9.8. This vector represents the worst-case attack scenario: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N).
The vulnerability exists in the authentication logic of the PAN-OS management web interface. The management interface fails to properly validate authentication state for certain request paths or sequences, allowing an attacker to bypass the login process entirely and gain access to administrative functionality. This means an attacker can send crafted HTTP requests to the management interface that are processed as if they came from an authenticated administrator session, without ever providing valid credentials.
Once the authentication bypass is achieved, the attacker has full PAN-OS administrator privileges, which include the ability to view and modify all firewall rules, manage VPN configurations, access user databases, modify system settings, and export configurations containing sensitive data. The scope is unchanged (S:U), but the practical impact extends far beyond the firewall itself since compromising a network security appliance provides a privileged position from which to attack the entire network it protects. Affected versions include PAN-OS 10.2.0 through 10.2.12, 11.0.0 through 11.0.6, 11.1.0 through 11.1.5, and 11.2.0 through 11.2.4. PAN-OS versions prior to 10.2 are not affected, and Cloud NGFW and Prisma Access deployments are not impacted.
Frequently Asked Questions
What is CVE-2024-0012?
CVE-2024-0012 is a critical authentication bypass vulnerability in Palo Alto Networks PAN-OS that allows an unauthenticated attacker with network access to the management web interface to gain full administrator privileges without credentials. It has a CVSS v3.1 score of 9.8.
Is CVE-2024-0012 being used in ransomware attacks?
Yes. CISA has confirmed a direct ransomware association for CVE-2024-0012. The vulnerability is being used as an initial access vector in attack chains that lead to ransomware deployment. Organizations with exposed PAN-OS management interfaces should treat this as an emergency.
How does CVE-2024-0012 chain with CVE-2024-9474?
CVE-2024-0012 provides unauthenticated access to the PAN-OS management interface with administrator privileges. CVE-2024-9474 then escalates those administrator privileges to root OS access. Together, they enable an unauthenticated attacker to achieve full root control over the firewall, representing a complete compromise of the network security device.
Is my PAN-OS device vulnerable if management access is restricted?
If your PAN-OS management web interface is only accessible from a trusted management network and not from the internet or untrusted segments, the risk is significantly reduced but not eliminated. Internal attackers or compromised internal hosts could still exploit the vulnerability. Patching is still required regardless of network restrictions.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.