Palo Alto Networks has disclosed a critical security vulnerabilities in PAN-OS that is actively being exploited by malicious actors. This threat advisory aims to provide comprehensive information on the issue and necessary actions to mitigate risks.
The vulnerability, tracked as CVE-2024-3400, is a combination of two bugs in PAN-OS versions 10.2, 11.0, and 11.1, allowing unauthenticated remote shell command execution.
The threat actor, UTA0218, conducted a two-stage attack named Operation MidnightEclipse, exploiting PAN-OS flaw for command execution on vulnerable devices.
Specially crafted requests containing commands are sent to devices, leveraging a backdoor named UPSTYLE. The attacker uses cron jobs and wget to execute commands and download malicious tools.
Approximately 22,542 internet-exposed firewall devices are vulnerable globally, with the majority located in the U.S., Japan, India, Germany, the U.K., Canada, Australia, France, and China.
Palo Alto Networks has released patches for affected PAN-OS versions. Users are strongly advised to apply hotfixes immediately to prevent exploitation.
If you have any questions or require further information on any other Cyber Security matters, please don’t hesitate to contact our dedicated team at [email protected].
If you want to see more about the SOC service we offer, please follow this link https://maidar.io.
To ask a question, go to our support portal.
