PT-2017-14301 · Palo Alto Networks · Pan-Os+1

Philip Pettersson · Published 2017-12-06 · Updated 2025-10-10 · CVE-2017-15944

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions prior to 6.1.19 Palo Alto Networks PAN-OS versions 7.0.x prior to 7.0.19 Palo Alto Networks PAN-OS versions 7.1.x prior to 7.1.14 Palo Alto Networks PAN-OS versions 8.0.x prior to 8.0.6

Description The issue allows remote attackers to execute arbitrary code via vectors involving the management interface. This can be achieved through the exploitation of a combination of unrelated vulnerabilities in the management interface of the device, allowing an attacker to remotely execute code on PAN-OS or Panorama in the context of the highest privileged user.

Recommendations For versions prior to 6.1.19, update to version 6.1.19 or later. For versions 7.0.x prior to 7.0.19, update to version 7.0.19 or later. For versions 7.1.x prior to 7.1.14, update to version 7.1.14 or later. For versions 8.0.x prior to 8.0.6, update to version 8.0.6 or later. As a temporary workaround, consider restricting access to the management interface until a patch is available.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-20

Related Identifiers

CVE-2017-15944

Affected Products

Pan-Os

Panorama

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/panos_readsessionvars.rb · Exploit
• 🔥 https://github.com/surajraghuvanshi/PaloAltoRceDetectionAndExploit · Exploit
• 🔥 https://exploit-db.com/exploits/43342 · Exploit
• 🔥 https://exploit-db.com/exploits/44597 · Exploit
• 🔥 https://d0n9.github.io/2018/01/26/CVE-2017-15944%20Palo%20Alto%E9%98%B2%E7%81%AB%E5%A2%99%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%9E%84%E9%80%A0%20EXP · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-15944 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15944 · Vendor Advisory
• http://securityfocus.com/bid/102079 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-15944 · Note
• https://t.me/poxek/2362 · Telegram Post
• https://reddit.com/r/pentest_tools_com/comments/1o31vdu/attackers_are_actively_scanning_for_vulnerable · Reddit Post
• https://security.paloaltonetworks.com/CVE-2017-15944 · Vendor Advisory, Security Note
• https://t.me/thehackernews/2494 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://t.me/cveNotify/130221 · Telegram Post