CVEvulnerability

CVE-2024-3387

5.9 MEDIUM Published 2024-04-10 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-04-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-326

Description

A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sensitive information that is shared between the management server and the firewalls.

Affected configurations

• paloaltonetworks pan-os (>= 10.1.0 < 10.1.12) • paloaltonetworks pan-os (>= 10.2.0 < 10.2.7) • paloaltonetworks pan-os (>= 11.0.0 < 11.0.4) • paloaltonetworks pan-os 10.2.7

Related

Weakness · CWE (1)

  • CWE-326 Inadequate Encryption Strength weakness

References