PT-2020-15223

CVE-2020-2000

Published

2020-11-11

Updated

2020-11-16

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PAN-OS versions earlier than 8.1.16 PAN-OS versions earlier than 9.0.10 PAN-OS versions earlier than 9.1.4 PAN-OS versions earlier than 10.0.1

Description An OS command injection and memory corruption issue in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code and OS commands with root privileges.

Recommendations For PAN-OS 8.1, update to version 8.1.16 or later. For PAN-OS 9.0, update to version 9.0.10 or later. For PAN-OS 9.1, update to version 9.1.4 or later. For PAN-OS 10.0, update to version 10.0.1 or later.

Exploitability

Fix

Impacts

Researchers

Nicholas Newsom

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-20: Improper Input Validation

CWE-121: Stack-based Buffer Overflow

Related identifiers