Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2021-3060

PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root user privileges. The attacker must have network access to the GlobalProtect interfaces to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers with Prisma Access 2.1 Preferred and Prisma Access 2.1 Innovation firewalls are impacted by this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks PAN-OS

  • 8.1 to < 8.1.20-h1affected
  • 9.0 to < 9.0.14-h3affected
  • 9.1 to < 9.1.11-h2affected
  • 10.0 to < 10.0.8affected
  • 10.1 to < 10.1.3affected

Palo Alto Networks Prisma Access

  • 2.1 Preferredaffected
  • 2.1 Innovationaffected
  • all to < 2.2*unaffected

References