Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2021-3059

PAN-OS: OS Command Injection Vulnerability When Performing Dynamic Updates

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables a man-in-the-middle attacker to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers that have Prisma Access 2.1 Preferred or Prisma Access 2.1 Innovation firewalls are impacted by this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks PAN-OS

  • 10.0 to < 10.0.8affected
  • 10.1 to < 10.1.3affected
  • 8.1 to < 8.1.20-h1affected
  • 9.0 to < 9.0.14-h3affected
  • 9.1 to < 9.1.11-h2affected

Palo Alto Networks Prisma Access

  • 2.1 Innovationaffected
  • 2.1 Preferredaffected
  • all to < 2.2*unaffected

References