TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

CIS Advisories

A Vulnerability in PAN-OS Could Allow for Remote Code Execution

5 hours ago · Read original ↗

ATT&CK techniques detected

3 predictions
T1190Exploit Public-Facing Application
98%
"10. 2 < 10. 2. 18 - h6 risk : government : businesses : home users : technical summary : a vulnerability has been discovered in the pan - os authentication portal ( aka captive portal ) service that could allow for remote code execution. details of the vulnerability are as follow…"
T1190Exploit Public-Facing Application
95%
"- restrict user - id™ authentication portal access to only trusted zones. - disable user - id™ authentication portal if not required. successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the pa - series and vm - …"
T1078.001Default Accounts
73%
"), hosted services, and physical premise controls ; frequency ; limitations, such as acceptable hours, and excluded attack types ; point of contact information ; remediation, such as how findings will be routed internally ; and retrospective requirements. - safeguard 18. 2 : perf…"

Summary

A vulnerability has been discovered in the PAN-OS Authentication Portal (aka Captive Portal) service that could allow for remote code execution. PAN-OS is the operating system that runs Palo Alto Networks next-generation firewalls. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.