CVERadar
Edition used by more than 30,000 companies in more than 150 countries.
Sign Up For FreeCVE-2024-0012
Critical Severity|Paloaltonetworks
89
SVRS
9.8
CVSSv3
0.94285
EPSS
TAGS
In The WildExploit AvaliableCISA KEVExploit Available
VECTOR STRING
CVSS:3.1AV:NAC:LPR:NUI:NS:UC:HI:HA:H
PUBLICATION DATE2024-11-18
LAST MODIFIED2025-10-21
Deep CVE Analysis in Progress
The system is currently conducting an in-depth analysis of the selected CVE. This includes advanced correlation, vulnerability classification, and cross-referencing with real-time threat intelligence sources. Once the analysis is complete, the page will automatically update with enriched vulnerability data and actionable insights.
Security Intelligence Brief
1. What is this vulnerability and why does it matter?
This vulnerability, CVE-2024-0012, is an authentication bypass in Palo Alto Networks PAN-OS software. It is critical because it allows an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges. With these privileges, an attacker can perform administrative actions, tamper with configurations, or exploit other authenticated privilege escalation vulnerabilities, such as CVE-2024-9474. The high CVSS score of 9.8 reflects the severe impact and ease of exploitation.
2. What are the CVSS score, severity level, and disclosure details?
The CVSS score for CVE-2024-0012 is 9.8, indicating a Critical severity level. The vulnerability was published on 2024-11-18 15:47:41 UTC and last modified on 2025-10-21 22:55:36 UTC.
3. Which products, vendors, systems, and versions are affected?
- Vendor: Palo Alto Networks
- Product: PAN-OS software
- Affected Versions: PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2.
- Not Impacted: Cloud NGFW and Prisma Access are not impacted by this vulnerability.
4. What is the technical root cause and attack vector?
- Technical Root Cause: The root cause is an authentication bypass vulnerability, classified under CWE-306 (Missing Authentication for Critical Function).
- Attack Vector: The attack vector involves an unauthenticated attacker gaining network access to the management web interface of the affected PAN-OS device.
5. How can this vulnerability be exploited?
This vulnerability can be exploited by an unauthenticated attacker who has network access to the management web interface of a vulnerable Palo Alto Networks PAN-OS device. By bypassing authentication, the attacker can gain full PAN-OS administrator privileges, enabling them to:
- Perform arbitrary administrative actions.
- Tamper with the device's configuration.
- Exploit other authenticated privilege escalation vulnerabilities, such as CVE-2024-9474, for further compromise.
6. What mitigation steps and patches are available?
- Mitigation: The primary mitigation step is to secure access to the management web interface by strictly restricting access to only trusted internal IP addresses. This should be done in accordance with Palo Alto Networks' recommended best practice deployment guidelines for securing management access.
- Patches: The provided CVE data does not explicitly state the availability of patches at this time. Organizations should monitor official Palo Alto Networks advisories for patch releases.
7. How can vulnerable systems be detected?
Vulnerable systems can be detected by identifying Palo Alto Networks devices running the affected PAN-OS software versions: 10.2, 11.0, 11.1, and 11.2. Additionally, organizations should audit their network configurations to determine if the management web interface of these devices is accessible from untrusted networks or IP addresses.
9. Which threat actors are known to exploit this vulnerability?
While the provided information states that active exploits have been published to exploit this vulnerability, specific threat actors are not named. This suggests the exploit code is publicly available, increasing the risk of widespread exploitation by various malicious actors.
10. What public intelligence references and advisories exist?
- CVE Identifier: CVE-2024-0012
- Related Vulnerability: CVE-2024-9474 (mentioned as an example for authenticated privilege escalation post-exploitation, with an advisory available at https://security.paloaltonetworks.com/CVE-2024-9474)
- Palo Alto Networks Deployment Guidelines: Recommended best practice deployment guidelines for securing management access are available at https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431
11. What is the risk assessment and urgency level?
- Risk Assessment: The risk is assessed as Critical. This authentication bypass allows unauthenticated attackers with network access to achieve full administrative control over the affected PAN-OS devices. The potential impact includes complete compromise of the device, configuration manipulation, and further network intrusion.
- Urgency Level: The urgency level is Immediate. Given the critical CVSS score of 9.8 and the confirmation that active exploits have been published, organizations must prioritize implementing the recommended mitigation steps without delay. Systems running affected versions with exposed management interfaces are at extremely high risk of compromise.
Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNTCVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.