CVE-2024-9474
Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
Description
CVE-2024-9474 is a high-severity privilege escalation vulnerability in Palo Alto Networks PAN-OS software that allows an authenticated administrator with access to the management web interface to perform actions on the firewall with root privileges. With a CVSS v3.1 base score of 7.2, the vulnerability affects multiple PAN-OS versions across the 10.1, 10.2, 11.0, 11.1, and 11.2 branches. Cloud NGFW and Prisma Access are not impacted. CISA has added CVE-2024-9474 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 9, 2024, with a confirmed ransomware association. Its EPSS score of 94.18% at the 99.9th percentile indicates near-certain exploitation, making this one of the most actively targeted vulnerabilities in network security infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | pan-os | >= 10.1.0, < 10.1.14; >= 10.2.0, < 10.2.12; >= 11.0.0, < 11.0.6; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.4; 10.1.14; 10.2.12; 11.0.6; 11.1.5; 11.2.4 |
References
- https://security.paloaltonetworks.com/CVE-2024-9474(Vendor Advisory)
- https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/(Press/Media Coverage, Vendor Advisory)
- https://github.com/k4nfr3/CVE-2024-9474(Exploit)
- https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9474(US Government Resource)
Weakness Type
Privilege Escalation in PAN-OS Management Interface
CVE-2024-9474 is a privilege escalation vulnerability in the Palo Alto Networks PAN-OS management web interface. The weakness allows an authenticated PAN-OS administrator to bypass the intended privilege boundaries of the management interface and execute operations with root-level operating system privileges. Under normal operation, the PAN-OS web interface constrains administrators to a defined set of management actions. This vulnerability breaks that containment, enabling an administrator to escape the application-level sandbox and interact directly with the underlying Linux operating system as root. This class of vulnerability is particularly dangerous in network security appliances because root access to a firewall undermines the entire security posture it is designed to protect.
Impact Analysis
The impact of CVE-2024-9474 is severe, with high ratings across all CIA triad dimensions. Confidentiality is fully compromised because root access to the PAN-OS operating system exposes all firewall configuration data, including security policies, VPN credentials, SSL/TLS certificates, user authentication databases, and encrypted traffic inspection keys. Attackers with root access can also capture network traffic passing through the firewall, exposing all communications the device is designed to protect.
Integrity faces maximum impact as root-level access allows the attacker to modify firewall rules, disable security features, create covert access pathways through the network, alter logging configurations to hide malicious activity, and install persistent backdoors in the operating system. An attacker could silently reconfigure the firewall to allow unauthorized traffic while maintaining the appearance of normal operation.
Availability is critically at risk since root access enables the attacker to disable the firewall entirely, corrupt its configuration, or degrade its performance to the point of service denial. The confirmed ransomware association elevates the threat considerably, as ransomware operators who gain root access to a firewall can use it as a staging point to pivot into the internal network and deploy ransomware across the organization. The EPSS score of 94.18% at the 99.9th percentile indicates near-certain active exploitation in the wild.
Exploit Maturity
CVE-2024-9474 has reached the highest levels of exploit maturity with confirmed active exploitation and a direct ransomware association. CISA's Known Exploited Vulnerabilities catalog entry confirms that this vulnerability is being used in real-world attacks, with a remediation deadline of December 9, 2024. The EPSS score of 94.18% at the 99.9th percentile places it in the top 0.1% of all vulnerabilities globally for exploitation probability.
Multiple public exploit resources are available. A proof-of-concept exploit has been published on GitHub by k4nfr3, and detailed technical analysis is available from watchTowr Labs, which documents exploitation of this vulnerability in combination with CVE-2024-0012. Palo Alto Networks' own Unit 42 threat intelligence team has published a detailed analysis at unit42.paloaltonetworks.com, confirming active exploitation campaigns. The confirmed ransomware association means this vulnerability has been directly linked to ransomware deployment, making it an immediate priority for all organizations running affected PAN-OS versions.
Remediation
-
Upgrade PAN-OS to a patched version immediately. Apply the security updates referenced in Palo Alto Networks' advisory at CVE-2024-9474. The specific patched versions are PAN-OS 10.1.14-h6, 10.2.12-h2, 11.0.6-h1, 11.1.5-h1, and 11.2.4-h1 or later on each respective branch.
-
Restrict management interface access. Ensure the PAN-OS management web interface is not accessible from the internet or untrusted networks. Follow Palo Alto Networks' best practice guidance to limit management access to dedicated management networks with strict IP allowlists. This is critical because this vulnerability is frequently chained with CVE-2024-0012, an authentication bypass that enables unauthenticated access.
-
Investigate for signs of compromise. Given the confirmed ransomware association and public exploit availability, any firewall running a vulnerable PAN-OS version with an exposed management interface should be treated as potentially compromised. Review firewall logs for unauthorized configuration changes, unexpected administrator sessions, unusual outbound connections, and any modifications to security policies or user accounts.
-
Rotate all credentials and certificates. After patching, rotate all credentials stored on or managed by the firewall, including administrator passwords, VPN pre-shared keys, SSL/TLS certificates used for decryption, LDAP service account credentials, and any API keys. An attacker with root access could have extracted all of these before the patch was applied.
-
Deploy network-level monitoring. Implement monitoring for management interface access attempts from unauthorized sources, unexpected configuration changes, and anomalous traffic patterns that may indicate the firewall is being used as a pivot point for lateral movement or data exfiltration.
Technical Details
CVE-2024-9474 is a privilege escalation vulnerability in Palo Alto Networks PAN-OS with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, resulting in a base score of 7.2. The attack is network-accessible (AV:N) with low complexity (AC:L), but requires high privileges (PR:H), meaning the attacker needs valid PAN-OS administrator credentials or must chain this vulnerability with an authentication bypass such as CVE-2024-0012.
The vulnerability exists within the PAN-OS management web interface's request handling logic. When an authenticated administrator submits certain operations through the web interface, the application processes these requests in a way that allows the administrator to escape the intended privilege boundaries. The management interface is designed to constrain administrators to a specific set of firewall management operations, but this vulnerability enables crafted requests to be executed with root operating system privileges rather than the restricted application-level privileges.
The scope is unchanged (S:U), meaning the vulnerability directly affects only the PAN-OS device, but the practical impact is far-reaching because compromising a firewall provides the attacker with a privileged network position from which to attack the entire internal network. All three impact metrics are rated high (C:H/I:H/A:H), reflecting that root access provides complete control over the device. Affected versions span PAN-OS 10.1.0 through 10.1.14, 10.2.0 through 10.2.12, 11.0.0 through 11.0.6, 11.1.0 through 11.1.5, and 11.2.0 through 11.2.4. Cloud NGFW and Prisma Access deployments are not affected.
Frequently Asked Questions
What is CVE-2024-9474?
CVE-2024-9474 is a privilege escalation vulnerability in Palo Alto Networks PAN-OS that allows an authenticated administrator to gain root-level operating system access through the management web interface. It has a CVSS v3.1 score of 7.2 (High) and is actively exploited in the wild.
Is CVE-2024-9474 linked to ransomware?
Yes. CISA has confirmed a direct ransomware association for CVE-2024-9474, meaning this vulnerability has been used in attacks that led to ransomware deployment. Organizations should treat patching as an emergency priority.
How does CVE-2024-9474 relate to CVE-2024-0012?
CVE-2024-0012 is an authentication bypass vulnerability in PAN-OS that allows unauthenticated access to the management interface. Attackers commonly chain CVE-2024-0012 with CVE-2024-9474 to achieve unauthenticated root access to PAN-OS firewalls. Both vulnerabilities should be patched simultaneously.
Which PAN-OS versions are affected?
PAN-OS versions 10.1.0 through 10.1.14, 10.2.0 through 10.2.12, 11.0.0 through 11.0.6, 11.1.0 through 11.1.5, and 11.2.0 through 11.2.4 are affected. Cloud NGFW and Prisma Access are not impacted. Patched versions are available for each branch.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.