CVE-2020-1999

PAN-OS: Threat signatures are evaded by specifically crafted packets

State: Published
Severity: 5.3 Medium
Published: Nov 12, 2020
Updated: Sep 17, 2024
Reserved: Dec 4, 2019

Description

A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the network in a way that is not analyzed for threats by sending data through specifically crafted TCP packets. This technique evades signature-based threat detection. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.17; PAN-OS 9.0 versions earlier than 9.0.11; PAN-OS 9.1 versions earlier than 9.1.5; All versions of PAN-OS 7.1 and PAN-OS 8.0.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	palo_alto

Weaknesses

CWE-754 Improper Check for Unusual or Exceptional Conditions

Affected Products

Product	Versions
PAN-OSPalo Alto Networks	7.1.Affected 8.0.Affected 10.0.*Not affected 8.1 to before 8.1.17Affectedfrom 8.1.17Not affected 9.0 to before 9.0.11Affectedfrom 9.0.11Not affected 9.1 to before 9.1.5Affectedfrom 9.1.5Not affected

References

https://security.paloaltonetworks.com/CVE-2020-1999

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.