The vulnerability is GlobalProtect. The vulnerability makes it possible to get root on a PaloAlto device – without any authentication (!). Unauth Command Injection. The manufacturer reports that the vulnerability is being exploited in real-world attacks.
This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 firewalls with the configurations for both GlobalProtect gateway and device telemetry enabled.
You can verify whether you have a GlobalProtect gateway configured by checking for entries in your firewall web interface (Network > GlobalProtect > Gateways) and verify whether you have device telemetry enabled by checking your firewall web interface (Device > Setup > Telemetry).
More on Palo Alto
Leave a comment