Every CVESearch/Get API key

CVE-2024-3400

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

10.0 CriticalIn KEVPublic exploit

CVE-2024-3400 is a critical vulnerability (CVSS 10.0) in Palo Alto Networks Cloud Ngfw, published April 12, 2024. CISA lists it as known to be exploited, since April 12, 2024. EUVD reports exploitation since April 12, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 100th percentile. No source names a fixed version.

What does this mean?
Severity
10.0 CriticalCVSS 3.1, CVE List
Exploit chance
100.0%EPSS, 100th percentile
Exploitation
ExploitedCISA KEV,
Fixed in
No fix listedNo source names one

Description

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 100.0 points since Apr 12, 2024
90%50%10%1%

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitPalo Alto Networks PAN-OS Unauthenticated Remote Code Execution2024-04-12
PoC in GitHub0x0d3ad/CVE-2024-34002024-04-13
PoC in GitHubCerTusHack/CVE-2024-3400-PoC2024-04-13
PoC in GitHubFoxyProxys/CVE-2024-34002024-04-13
PoC in GitHubYuvvi01/CVE-2024-34002024-04-13
PoC in GitHubMrR0b0t19/CVE-2024-34002024-04-14
PoC in GitHubmomika233/CVE-2024-34002024-04-14
PoC in GitHubMurrayR0123/CVE-2024-3400-Compromise-Checker2024-04-15
PoC in GitHubAdaniKamal/CVE-2024-34002024-04-16
PoC in GitHubCONDITIONBLACK/CVE-2024-3400-POC2024-04-16
Show 18 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubChocapikk/CVE-2024-34002024-04-16
PoC in GitHubLoanVitor/CVE-2024-3400-2024-04-16
PoC in GitHubW01fh4cker/CVE-2024-3400-RCE-Scan2024-04-16
PoC in GitHubh4x0r-dz/CVE-2024-34002024-04-16
PoC in GitHubihebski/CVE-2024-34002024-04-16
PoC in GitHubZephrFish/CVE-2024-3400-Canary2024-04-17
PoC in GitHubak1t4/CVE-2024-34002024-04-17
PoC in GitHubindex2014/CVE-2024-3400-Checker2024-04-17
PoC in GitHubretkoussa/CVE-2024-34002024-04-17
PoC in GitHubRavaan21/CVE-2024-34002024-04-18
PoC in GitHubcodeblueprint/CVE-2024-34002024-04-18
PoC in GitHubhahasagined/CVE-2024-34002024-04-18
PoC in GitHubschooldropout1337/CVE-2024-34002024-04-18
PoC in GitHubswaybs/CVE-2024-34002024-04-18
PoC in GitHubsxyrxyy/CVE-2024-3400-Check2024-04-18
PoC in GitHubtfrederick74656/cve-2024-3400-poc2024-04-18
Exploit-DBPalo Alto PAN-OS < v11.1.2-h3 - Command Injection and Arbitrary File Creation2024-04-21
NucleiGlobalProtect - OS Command Injection

What each source reports

CVE List Score used10.0

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Record
CVE-2024-3400
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-77, CWE-20
Updated
2026-11-02
EUVDEUVD-2024-3198910.0

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Record
EUVD-2024-31989
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-v475-xhc9-wfxg9.8

A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS...

A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Fixes for PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 are in development and are expected to be released by April 14, 2024. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability. All other versions of PAN-OS are also not impacted.

Record
GHSA-v475-xhc9-wfxg
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20, CWE-77
Updated
2026-11-02
CISA KEVNo score

Palo Alto Networks PAN-OS Command Injection Vulnerability

Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.

Record
CVE-2024-3400
Weakness
CWE-20, CWE-77
Updated
2026-11-02
NVD10.0

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Record
CVE-2024-3400
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-20, CWE-77
Updated
2026-11-02

History

History
RecordedChangedSources
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

This page doesn't list everything

The full exploit list has 20 more links.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open