Security readout for executives and security teams
Plain-English summary
CVE-2024-0012 can let an unauthenticated attacker who can reach a vulnerable PAN-OS management web interface obtain administrator privileges. The attacker could change firewall configuration or combine access with another vulnerability. Because CISA lists it as known exploited, reachable systems require urgent attention.
Executive priority
Treat this as an immediate remediation priority, especially for internet-reachable management interfaces. CISA confirms known exploitation, and successful compromise grants control over a security enforcement device. Restrict access now, confirm vendor-fixed versions, upgrade promptly, and investigate potentially exposed systems for unauthorized administrative or configuration activity.
Technical view
This is a CWE-306 authentication bypass affecting the management web interface of PAN-OS 10.2, 11.0, 11.1, and 11.2. It requires network access but no credentials or user interaction. Successful exploitation provides administrative privileges and may be chained with authenticated privilege-escalation flaws such as CVE-2024-9474. CVSS v4.0 is 9.3.
Likely exposure
Exposure exists where affected PAN-OS versions run and an attacker can reach the management web interface. Internet-accessible management interfaces present the clearest risk; restricting access to trusted internal IP addresses substantially reduces it. Cloud NGFW and Prisma Access are explicitly unaffected. The supplied evidence does not identify exact fixed release numbers.
Exploitation context
CISA's Known Exploited Vulnerabilities catalog supports active exploitation in the wild. Exploitation requires network reachability to the management web interface, not credentials or user interaction. The bypass may enable configuration tampering directly or support a vulnerability chain. The supplied evidence does not quantify affected organizations or provide reliable indicators of compromise.
Researcher notes
The vulnerable boundary is the PAN-OS management web interface, with network reachability as the principal exposure condition. The vendor describes complete administrative impact and possible chaining with CVE-2024-9474. Version claims should follow the narrative scope of 10.2, 11.0, 11.1, and 11.2; the supplied affected-data fields contain ambiguity concerning 10.1.
Mitigation direction
- Restrict management web interface access to trusted internal IP addresses immediately.
- Remove direct internet reachability and enforce dedicated administrative network controls.
- Check Palo Alto Networks' current advisory for the exact fixed release applicable to each device.
- Upgrade affected PAN-OS installations to the vendor-designated fixed release.
- Review administrator access and configuration integrity after remediation.
Validation and detection
- Inventory devices running PAN-OS 10.2, 11.0, 11.1, or 11.2.
- Verify which networks and addresses can reach every management web interface.
- Confirm installed versions against the current Palo Alto Networks advisory.
- Review administrative activity, accounts, and configuration changes for anomalies.
- Verify access restrictions and the vendor-designated fixed release after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-0012 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- Yes
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red——palo_altoCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red——palo_altoVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red
Base CVSS 4.0 score
5.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelinepalo_alto
Initially published as PAN-SA-2024-0015
- Source timelinepalo_alto
Added instructions to find your devices with an internet-facing management interface discovered in our scans
- Source timelinepalo_alto
Raised the severity of PAN-SA-2024-0015 bulletin as we have observed threat activity
- Source timelinepalo_alto
Answered a FAQ about indicators of compromise
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2024-0012 added to CISA KEV
- Source timelinepalo_alto
CVE-2024-0012 assigned to this publication as the vulnerability is identified and fixed
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2024-11-18T00:00:00.000Z: CVE-2024-0012 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://security.paloaltonetworks.com/CVE-2024-0012CVE reference, palo_alto · vendor-advisory
- https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/CVE reference, CISA-ADP
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-0012CVE reference, CISA-ADP · government-resource
- https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.