Description
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Cloud NGFW | Palo Alto Networks / Cloud NGFW | All | unaffected |
| PAN-OS | Palo Alto Networks / PAN-OS | >= 10.2.0, < 10.2.18-h6 | affected |
| PAN-OS | Palo Alto Networks / PAN-OS | >= 11.1.0, < 11.1.15 | affected |
| PAN-OS | Palo Alto Networks / PAN-OS | >= 11.2.0, < 11.2.12 | affected |
| PAN-OS | Palo Alto Networks / PAN-OS | >= 12.1.0, < 12.1.7 | affected |
| Prisma Access | Palo Alto Networks / Prisma Access | All | unaffected |
| RUGGEDCOM APE1808 | Siemens / RUGGEDCOM APE1808 | >= 0, < * | affected |