Palo Alto Networks has launched new indicators of compromise (IoCs) a day after the community safety vendor confirmed {that a} new zero-day vulnerability impacting its PAN-OS firewall administration interface has been actively exploited within the wild.
To that finish, the corporate stated it noticed malicious exercise originating from beneath IP addresses and focusing on PAN-OS administration internet interface IP addresses which might be accessible over the web –
- 136.144.17[.]*
- 173.239.218[.]251
- 216.73.162[.]*
The corporate, nevertheless, warned that these IP addresses might probably characterize “third-party VPNs with authentic consumer exercise originating from these IPs to different locations.”
Palo Alto Networks’ up to date advisory signifies that the flaw is being exploited to deploy an internet shell on compromised gadgets, permitting menace actors to achieve persistent distant entry.
The vulnerability, which is but to be assigned a CVE identifier, carries a CVSS rating of 9.3, indicating crucial severity. It permits for unauthenticated distant command execution.
In accordance with the corporate, the vulnerability requires no consumer interplay or privileges to use, and its assault complexity has been deemed “low.”
That stated, the severity of the flaw drops to excessive (CVSS rating: 7.5) ought to entry to the administration interface be restricted to a restricted pool of IP addresses, through which case the menace actor must get hold of privileged entry to these IPs first.
On November 8, 2024, Palo Alto Networks started advising prospects to safe their firewall administration interfaces amid studies of a distant code execution (RCE) flaw. It has since been confirmed that the mysterious vulnerability has been abused in opposition to a “restricted quantity” of cases.
There are at present no particulars on how the vulnerability got here to gentle, the menace actors behind the exploitation, and the targets of those assaults. Prisma Entry and Cloud NGFW merchandise usually are not impacted by the flaw.
Patches for the vulnerability are but to be launched, making it crucial that customers take speedy steps to safe entry to the administration interface, if not already.
The advisory comes as three totally different crucial flaws within the Palo Alto Networks Expedition (CVE-2024-5910, CVE-2024-9463, and CVE-2024-9465) have come below energetic exploitation, per the U.S. Cybersecurity and Infrastructure Safety Company (CISA). At this stage, there is no such thing as a proof to recommend that the actions are associated.
(It is a growing story. Please examine again for extra updates.)
