Source: www.securityweek.com – Author: Eduard Kovacs
Palo Alto Networks is urging customers to ensure that access to the PAN-OS management interface is secured, in light of claims about a remote code execution vulnerability.
The cybersecurity giant’s advisory suggests that someone has claimed to have found a new RCE vulnerability in the PAN-OS management interface. The source of the information is unclear.
The company says it’s actively monitoring for signs of exploitation, but to date it has not seen any indication of a zero-day being exploited.
On the other hand, it has admitted that for the time being it does “not know the specifics of the claimed vulnerability”, noting that it also does not have sufficient information about any indicators of compromise (IoCs).
However, Palo Alto Networks is confident that securing the PAN-OS management interface would mitigate the risk, regardless of what the vulnerability is. It also believes that Prisma Access and cloud NGFW products would not be affected.
“We strongly recommend customers to ensure access to your management interface is configured correctly in accordance with our recommended best practice deployment guidelines,” Palo Alto Networks said in its advisory.
“In particular, we recommend that you ensure that access to the management interface is possible only from trusted internal IPs and not from the Internet. The vast majority of firewalls already follow this Palo Alto Networks and industry best practice,” it added.
The company has shared instructions for identifying internet-exposed management interfaces and how to secure them.
Advertisement. Scroll to continue reading.
The news comes shortly after CISA added a Palo Alto Networks Expedition flaw tracked as CVE-2024-5910 to its Known Exploited Vulnerabilities Catalog.
The vulnerability, patched in July, allows an attacker to take over an admin account and gain access to sensitive information. Technical details on the vulnerability have been available since early October, but there is no public information on the attacks exploiting the flaw.
Related: State-Sponsored Hackers Exploit Zero-Day to Backdoor Palo Alto Networks Firewalls
Related: Thousands of Palo Alto Firewalls Potentially Impacted by Exploited Vulnerability
Related: Palo Alto Networks Patches Unauthenticated Command Execution Flaw in Cortex XSOAR
Original Post URL: https://www.securityweek.com/palo-alto-networks-addresses-remote-code-execution-vulnerability-claims/
Category & Tags: Vulnerabilities,Palo Alto Networks,vulnerability – Vulnerabilities,Palo Alto Networks,vulnerability
Views: 2
