Flash Notice: Palo Alto Vulnerability Exploited in the Wild

overview

This week, Palo Alto discovered a vulnerability within the GlobalProtect feature of Palo Alto Networks PAN-OS Software. Distinct feature configurations within specific versions of PAN-OS may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.  

CVE-2024-3400 (CVSS 10)

The affected versions of PAN-OS are: PAN-OS 10.2, 11.0, AND 11.1. In order for an attacker to exploit this vulnerability, both GlobalProtect gateway and device telemetry must be enabled in the affected version of PAN-OS.  

Users can verify whether you have a GlobalProtect gateway configured by checking for entries in your firewall web interface (Network > GlobalProtect > Gateways) and verify whether you have device telemetry enabled by checking your firewall web interface (Device > Setup > Telemetry). 

Palo Alto anticipates hotfix releases of all affected PAN-OS versions no later than April 14. To mitigate the impact of this vulnerability, you can disable device telemetry until the hotfix has been applied.  

Palo Alto is aware of a number of attacks that exploit this vulnerability. 

avertium's recommendationS

INDICATORS OF COMPROMISE (IoCs)

At this time, all IoC’s associated with exploitation of this vulnerability are being held by Palo-Alto. A Technical Support file can be uploaded to the Palo Alto Customer Support Portal to to determine if a specific device has logs indicating the vulnerability has been exploited.  

Avertium remains vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive 

How Avertium is Protecting Our CUSTOMERS

• Fusion MXDR is the first MDR offering that fuse together all aspects of security operations into a living, breathing, threat-resistant XDR solution. By fusing insights from threat intelligence, security assessments, and vulnerability management into our MDR approach, Fusion MXDR offers a more informed, robust, and cost-effective approach to cybersecurity – one that is greater than the sum of its parts. 
• Minimizing the impact of a successful ransomware or malware attack requires detecting it as early in the attack as possible. A Security Information and Event Management (SIEM) system can help an organization to accomplish this. Avertium offers a comprehensive SIEM-based approach that increases the potential for detecting a ransomware infection before it deploys. SIEM provides a holistic overview of a company’s IT environment from a single point of view in terms of its specific security events, empowering teams to detect and analyze unusual behavior. 
• Note: We highly value your feedback. Kindly spare a moment to complete our feedback form, allowing us to enhance our services for our valued customers. 

SUPPORTING DOCUMENTATION