In the Face of Possible RCE Threat Concerns, Palo Alto Suggests Safeguarding PAN-OS Interface
On Friday, Palo Alto Networks released an advisory alerting customers to ensure the protection of the PAN-OS interface due to a potential threat from remote code execution.
“An assertion has been made regarding the existence of a remote code execution vulnerability through the PAN-OS management interface,” the corporation stated. “As of now, the particular details of this alleged vulnerability remain unknown. We are actively keeping an eye out for any signs of exploitation.”
As an immediate measure, the cybersecurity company has suggested that users appropriately configure the management interface following recommended practices and ensure that access to it is restricted solely to trusted internal IPs to reduce the potential for attacks.
It is essential to underline that exposing the management interface to the internet should be avoided. Some of the alternative recommendations to minimize exposure include –
- Set apart the management interface on a dedicated management VLAN
- Utilize jump servers for accessing the management IP
- Restrict inbound IP addresses to the management interface to approved management devices
- Allow secured communication such as SSH, HTTPS exclusively
- Permit only PING for testing connectivity to the interface
The revelation follows on the heels of the U.S. Cybersecurity and Infrastructure Security Agency (CISA) announcing a critical security vulnerability affecting Palo Alto Networks Expedition that has since been patched and added to its Known Exploited Vulnerabilities (KEV) database, highlighting indications of ongoing attacks.
The identified vulnerability, tagged as CVE-2024-5910 (CVSS score: 9.3), centers around an instance of absence of authentication in the Expedition migration tool that could facilitate a takeover of an admin account and potential access to sensitive data.
Though the exact exploitation method currently remains unknown, federal agencies have been advised to implement the necessary patches by November 28, 2024, to fortify their networks against this threat.
About Author
