Riskcovery

CVE-2021-3060

PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)

State
Published
Severity
8.1 High
Published
Nov 10, 2021
Updated
Sep 16, 2024
Reserved
Jan 6, 2021

Read the record on cve.org

Description

An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root user privileges. The attacker must have network access to the GlobalProtect interfaces to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers with Prisma Access 2.1 Preferred and Prisma Access 2.1 Innovation firewalls are impacted by this issue.

Scores

CVSSScoreVectorSource
3.18.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hpalo_alto

Weaknesses

Affected Products

ProductVersions
PAN-OSPalo Alto Networks
  • 8.1 to before 8.1.20-h1Affectedfrom 8.1.20-h1Not affected
  • 9.0 to before 9.0.14-h3Affectedfrom 9.0.14-h3Not affected
  • 9.1 to before 9.1.11-h2Affectedfrom 9.1.11-h2Not affected
  • 10.0 to before 10.0.8Affectedfrom 10.0.8Not affected
  • 10.1 to before 10.1.3Affectedfrom 10.1.3Not affected
Prisma AccessPalo Alto Networks
  • 2.1 PreferredAffected
  • 2.1 InnovationAffected
  • all to before 2.2*Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.