PAN-OS - RCE (CVE-2024-3400)
Background noise — opportunistic, automated scanning
Patch within your standard maintenance window. Alerts are likely low-signal.
Description
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.
Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
psychologyCrowdSec Analysis
CVE-2024-3400 is a critical vulnerability affecting Palo Alto Networks PAN-OS software, where attackers can exploit the GlobalProtect interface to achieve unauthenticated remote code execution with root privileges on vulnerable devices.
CrowdSec has been tracking this vulnerability and its exploits since 24th of April 2024.
According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2024-3400 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2024-3400. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.
Attempts at exploitation typically involve requests to URLs containing /global-protect/login.esp.
Exploitation Timeline
groupSignals collected from the CrowdSec community network.
| Event | Date |
|---|---|
| CVE Published | 2024-04-12 |
| CISA KEV | 2024-04-12 |
| CISA Remediation Deadline | 2024-04-19 |
| Rule Released | 2024-04-24 |
| CrowdSec First Seen | 2024-04-24 |
| Limited Exploitationtrending_upActive Exploitation | 2026-10-08 |
| Active Exploitationtrending_downLimited Exploitation | 2026-10-11 |
| Limited Exploitationtrending_upActive Exploitation | 2026-10-18 |
| Active Exploitationtrending_downBackground Noise | 2026-10-21 |
Active Attackers
Unique IPs observed exploiting this CVE in the last 14 days.
Related Weaknesses
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Remediation & Protection
codeAPI Access
Retrieve full intelligence data for CVE-2024-3400
External References
- https://security.paloaltonetworks.com/CVE-2024-3400
- https://unit42.paloaltonetworks.com/cve-2024-3400/
- https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3400.yaml