PT-2020-3480 · Palo Alto Networks · Pan-Os

Nicholas Newsom · Published 2020-05-13 · Updated 2020-06-10 · CVE-2020-2010

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PAN-OS versions 7.1 through 8.1.13 PAN-OS versions 9.0 through 9.0.6

Description The issue is an OS command injection vulnerability in the PAN-OS management interface. This allows an authenticated administrator to execute arbitrary OS commands with root privileges. The vulnerability exists due to the lack of neutralization of special elements used in the OS command.

Recommendations For PAN-OS versions 7.1 through 8.1.13, update to version 8.1.14 or later. For PAN-OS versions 9.0 through 9.0.6, update to version 9.0.7 or later. As a temporary workaround, consider restricting access to the management interface to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-03804

CVE-2020-2010

Affected Products

Pan-Os

References · 4

• https://osv.dev/vulnerability/CVE-2020-2010 · Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2020-2010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2010 · Security Note
• https://bdu.fstec.ru/vul/2020-03804 · Security Note