CVEvulnerability

CVE-2022-0024

7.2 HIGH Published 2022-05-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-05-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
Weaknesses
CWE-138

Description

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committed on both hardware and virtual firewalls. This issue does not impact Panorama appliances or Prisma Access customers. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.23; PAN-OS 9.0 versions earlier than PAN-OS 9.0.16; PAN-OS 9.1 versions earlier than PAN-OS 9.1.13; PAN-OS 10.0 versions earlier than PAN-OS 10.0.10; PAN-OS 10.1 versions earlier than PAN-OS 10.1.5.

Affected configurations

• paloaltonetworks pan-os (>= 8.1.0 < 8.1.23) • paloaltonetworks pan-os (>= 9.0.0 < 9.0.16) • paloaltonetworks pan-os (>= 9.1.0 < 9.1.13) • paloaltonetworks pan-os (>= 10.0.0 < 10.0.10) • paloaltonetworks pan-os (>= 10.1.0 < 10.1.5)

Related

Weakness · CWE (1)

  • CWE-138 Improper Neutralization of Special Elements weakness

References