CVE-2022-0024 PAN-OS: Improper Neutralization Vulnerability Leads to Unintended Program Execution During Configuration Commit

High 7.2 Published 11 May 2022 Updated 17 Sep 2024

An authenticated administrator can execute arbitrary code with root privileges by uploading a malicious configuration file to PAN-OS firewalls.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-0024?

CVE-2022-0024 is a high-severity code injection vulnerability in Paloaltonetworks Pan-Os, published on 11 May 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committed on both hardware and virtual firewalls. This issue does not impact Panorama appliances or Prisma Access customers. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.23; PAN-OS 9.0 versions earlier than PAN-OS 9.0.16; PAN-OS 9.1 versions earlier than PAN-OS 9.1.13; PAN-OS 10.0 versions earlier than PAN-OS 10.0.10; PAN-OS 10.1 versions earlier than PAN-OS 10.1.5.

Weakness: CWE-138

Which versions are affected by CVE-2022-0024?

It affects 1 product.

Products include Paloaltonetworks Pan-Os.

How do I fix CVE-2022-0024?

No fix has been published for CVE-2022-0024 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-0024 being exploited?

There is no known exploitation of CVE-2022-0024 in the wild and no public exploit code.

All Paloaltonetworks Pan-Os vulnerabilities

Sources

Also known as GHSA-3pp8-2gww-9cc2.