PT-2022-2179 · Palo Alto Networks · Pan-Os

Published 2022-03-09 · Updated 2022-03-12 · CVE-2022-0022

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 8.1 through 8.1.20 Palo Alto Networks PAN-OS versions 9.0 Palo Alto Networks PAN-OS versions 9.1 through 9.1.10 Palo Alto Networks PAN-OS versions 10.0 through 10.0.6

Description The issue is related to the usage of a weak cryptographic algorithm in the password hashes of administrator and local user accounts in Palo Alto Networks PAN-OS software. This weakness allows for password cracking attacks on accounts in normal operational mode. An attacker must have access to the account password hashes to exploit this issue, which can be acquired by gaining access to the PAN-OS software configuration.

Recommendations For PAN-OS 8.1 versions earlier than 8.1.21, update to version 8.1.21 or later. For all versions of PAN-OS 9.0, update to a fixed version of PAN-OS software. For PAN-OS 9.1 versions earlier than 9.1.11, update to version 9.1.11 or later. For PAN-OS 10.0 versions earlier than 10.0.7, update to version 10.0.7 or later.

Fix

Weakness Enumeration

CWE-916

Related Identifiers

BDU:2022-02204

CVE-2022-0022

Affected Products

Pan-Os

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-0022 · Security Note
• https://security.paloaltonetworks.com/CVE-2022-0022 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02204 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0022 · Vendor Advisory