erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: April 12, 2024

1 editorial brief and 1 known exploited (cisa kev) addition.

All digests · RSS · Markdown

Take stock

  • Act now: Operation MidnightEclipse. Owners of PAN-OS 10.2, 11.0 or 11.1 firewalls (including customer-managed VM-Series) with a GlobalProtect gateway or portal configured.
  • Do you run any of these? Palo Alto Networks PAN-OS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-04-19.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2024-3400

PAN-OS GlobalProtect Zero-Day RCE (CVE-2024-3400)

Any PAN-OS 10.2, 11.0 or 11.1 firewall with a GlobalProtect gateway or portal that is not on a fixed hotfix is exposed to unauthenticated root code execution and should be patched and checked immediately.

Must act: Owners of PAN-OS 10.2, 11.0 or 11.1 firewalls (including customer-managed VM-Series) with a GlobalProtect gateway or portal configured.

Can relax: Cloud NGFW, Panorama and Prisma Access customers, firewalls on PAN-OS 9.0, 9.1, 10.0 or 10.1, and firewalls without GlobalProtect configured.

  1. Confirm whether GlobalProtect is configured (Network > GlobalProtect > Gateways / Portals) and check the PAN-OS version.
  2. Upgrade to a fixed hotfix for your branch, or a later supported release.
  3. Until patched, apply Threat Prevention Threat IDs 95187, 95189 and 95191 with vulnerability protection on the GlobalProtect interface; disabling telemetry is not a mitigation.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2024-3400Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS Command Injection Vulnerability Ransomware		2024-04-19

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.