Riskcovery

CVE-2024-0009

PAN-OS: Improper IP Address Verification in GlobalProtect Gateway

State
Published
Severity
6.3 Medium
Published
Feb 14, 2024
Updated
Aug 1, 2024
Reserved
Nov 9, 2023

Read the record on cve.org

Description

An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a VPN connection from an unauthorized IP address.

Scores

CVSSScoreVectorSource
3.16.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lpalo_alto

Weaknesses

  • CWE-940 Improper Verification of Source of a Communication Channel

Affected Products

ProductVersions
PAN-OSPalo Alto Networks
  • 9.0Not affected
  • 9.1Not affected
  • 10.1Not affected
  • 10.2 to before 10.2.4Affectedfrom 10.2.4Not affected
  • 11.0 to before 11.0.1Affectedfrom 11.0.1Not affected
  • 11.1Not affected
Prisma AccessPalo Alto Networks
  • AllNot affected
Cloud NGFWPalo Alto Networks
  • AllNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.