PT-2024-7398 · Palo Alto Networks · Palo Alto Networks Cortex Xdr Agent

Published 2024-10-03 · Updated 2024-12-13 · CVE-2024-9469

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Cortex XDR Agent (affected versions not specified)

Description: A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity. The vulnerability is related to insufficient checking of unusual or exceptional states.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2024-08768

CVE-2024-9469

Affected Products

Palo Alto Networks Cortex Xdr Agent

References · 10

• https://osv.dev/vulnerability/CVE-2024-9469 · Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2024-9469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9469 · Security Note
• https://bdu.fstec.ru/vul/2024-08768 · Security Note
• https://blog.scrt.ch/2024/12/05/attacking-cortex-xdr-from-an-unprivileged-user-perspective · Note
• https://twitter.com/CVEnew/status/1844064007684046949 · Twitter Post
• https://vuldb.com/?id.279898 · Note
• https://t.me/cvedetector/7510 · Telegram Post
• https://t.me/cybersecuritytechnologies/11552 · Telegram Post
• https://t.me/cvenotify/98170 · Telegram Post