Analyst207Apr 21

CISA Catalog Adds 8 Exploited Flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) just beefed up its catalog of actively exploited software flaws by adding eight new entries, including three Cisco vulnerabilities and a high-severity PaperCut flaw. Federal agencies now have until April and May 2026 to mitigate these risks.

https://osintsights.com/cisa-catalog-adds-8-exploited-flaws?utm_source=mastodon&utm_medium=social

#Cisa #ExploitedVulnerabilities #KnownExploitedVulnerabilitiesCatalog #KevCatalog #Cisco

CISA Catalog Adds 8 Exploited Flaws

Discover the 8 new flaws added to CISA's Known Exploited Vulnerabilities catalog and learn how to protect your systems - read now and stay secure!

OSINTSights
Show threadNot SimonApr 20, 2024

Palo Alto Networks released additional details about CVE-2024-3400: the fact that it is a combination of two bugs in PAN-OS; how an attacker was exploiting it; how disabling telemetry initially worked; and how they fixed it. The timeline from discovery to remediation encompasses the whole blog post. Overall a comprehensive after-action review from a company that notified the public almost immediately of an exploited zero-day. đź”—https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/

#CVE_2024_3400 #PaloAltoNetworks #zeroday #activeexploitation #eitw #kev #KnownExploitedVulnerabilitiesCatalog #vulnerability #ProofofConcept #PANOS #IOC

More on the PAN-OS CVE-2024-3400

PSIRT learned of a suspicious exfiltration attempt at a customer site. Palo Alto Network's team investigated the issue with Volexity's team.

Palo Alto Networks Blog
Show threadNot SimonApr 18, 2024

Zscaler observed exploitation of the Palo Alto Networks PAN-OS command injection zero-day vulnerability CVE-2024-3400 following the release of the PoC exploit code. Zscaler provides an attack flow diagram, and a technical analysis of the Upstyle backdoor and its layers. IOC provided. đź”— https://www.zscaler.com/blogs/security-research/look-cve-2024-3400-activity-and-upstyle-backdoor-technical-analysis

#CVE_2024_3400 #PaloAltoNetworks #zeroday #activeexploitation #eitw #kev #KnownExploitedVulnerabilitiesCatalog #vulnerability #ProofofConcept #threatintel #IOC

A Look at CVE-2024-3400 Activity and Upstyle Backdoor Technical Analysis

Delve into CVE-2024-3400, a zero-day command-injection flaw in PAN-OS. Uncover exploitation trends in Zscaler's intelligence network and a Python-based backdoor

Show threadNot SimonApr 17, 2024

TrustedSec CTO Justin Elze shared CVE-2024-3400 exploit in the wild on Twitter yesterday, reports that 149.28.194.95 was attempting to exploit CVE-2024-3400

#CVE_2024_3400 #PaloAltoNetworks #zeroday #activeexploitation #eitw #kev #KnownExploitedVulnerabilitiesCatalog #vulnerability #ProofofConcept #threatintel #IOC

Show threadNot SimonApr 17, 2024

In case you missed it, Palo Alto Networks updated their security advisory in terms of product and mitigation guidance, exploit status, and PAN-OS fix availability: đź”— https://security.paloaltonetworks.com/CVE-2024-3400

  • Exploitation status: Proof of concepts for this vulnerability have been publicly disclosed by third parties.
  • Workarounds and mitigations: In earlier versions of this advisory, disabling device telemetry was listed as a secondary mitigation action. Disabling device telemetry is no longer an effective mitigation. Device telemetry does not need to be enabled for PAN-OS firewalls to be exposed to attacks related to this vulnerability.
  • Solution:
    • - 10.2.6-h3 (Released 4/16/24)
    • - 11.0.3-h10 (Released 4/16/24)
    • - 11.0.2-h4 (Released 4/16/24)
    • - 11.1.0-h3 (Released 4/16/24)

#CVE_2024_3400 #PaloAltoNetworks #zeroday #activeexploitation #eitw #kev #KnownExploitedVulnerabilitiesCatalog #vulnerability #ProofofConcept

CVE-2024-3400 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurat...

Palo Alto Networks Product Security Assurance
Show threadNot SimonApr 16, 2024

watchTowr may have successfully replicated CVE-2024-3400 (10.0 critical, disclosed 12 April 2024 by Palo Alto Networks as an exploited zero-day, CWE-77: Command Injection; OS Command Injection Vulnerability in GlobalProtect Gateway, added to CISA KEV Catalog). Instead of releasing a Proof of Concept, they provided a "detection artefact generator tool" đź”— https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/

#CVE_2024_3400 #PaloAltoNetworks #zeroday #activeexploitation #eitw #kev #KnownExploitedVulnerabilitiesCatalog #vulnerability #threatintel #IOC

Palo Alto - Putting The Protecc In GlobalProtect (CVE-2024-3400)

Welcome to April 2024, again. We’re back, again. Over the weekend, we were all greeted by now-familiar news—a nation-state was exploiting a “sophisticated” vulnerability for full compromise in yet another enterprise-grade SSLVPN device. We’ve seen all the commentary around the certification process of these devices for certain

watchTowr Labs - Blog
Show threadNot SimonApr 16, 2024

@jullrich of SANS ISC warns that the widely shared GitHub exploit is almost certainly fake (cc: @mttaggart ) and two IP addresses were attempting CVE-2024-3400 exploitation: 173.255.223.159 and 146.70.192.174 đź”— https://isc.sans.edu/diary/rss/30838

#CVE_2024_3400 #PaloAltoNetworks #zeroday #activeexploitation #eitw #kev #KnownExploitedVulnerabilitiesCatalog #vulnerability #threatintel #IOC

Show threadNot SimonApr 15, 2024

Happy hotfix day from Palo Alto Networks who released 3 hotfixes for CVE-2024-3400 (10.0 critical, disclosed 12 April 2024 as an exploited zero-day) with 15 more hotfixes expected in the coming days: đź”— https://security.paloaltonetworks.com/CVE-2024-3400

  • PAN-OS 10.2:
    • 10.2.9-h1 (Released 14 April)
    • 10.2.8-h3 (Released 15 April)
    • 10.2.7-h8 (Released 15 April)
    • 10.2.6-h3 (Released 16 April)
    • 10.2.5-h6 (Released 16 April)
    • 10.2.3-h13 (Released 18 April)
    • 10.2.1-h2 (Released 18 April)
    • 10.2.2-h5 (Released 18 April)
    • 10.2.0-h3 (Released 18 April)
    • 10.2.4-h16 (Released 18 April)
  • PAN-OS 11.0:
    • 11.0.4-h1 (Released 14 April)
    • 11.0.4-h2 (Released 17 April)
    • 11.0.3-h10 (Released: 16 April)
    • 11.0.2-h4 (Released 16 April)
    • 11.0.1-h4 (Released 18 April)
    • 11.0.0-h3 (Released 18 April)
  • PAN-OS 11.1:
    • 11.1.2-h3 (Released 14 April)
    • 11.1.1-h1 (Released 16 April)
    • 11.1.0-h3 (Released: 16 April)

#CVE_2024_3400 #PaloAltoNetworks #zeroday #activeexploitation #eitw #kev #KnownExploitedVulnerabilitiesCatalog #vulnerability #threatintel #IOC

CVE-2024-3400 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurat...

Palo Alto Networks Product Security Assurance
Show threadNot SimonApr 14, 2024

It should come as no surprise that Palo Alto Networks did not release hotfixes* for affected versions of PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11 by the self-imposed deadline of Sunday 14 April 2024 like they estimated in their security advisory. 48 hours to develop/test/release is a tight delivery window with the whole infosec community breathing down their necks.

EDIT: A hotfix is now available for select affected versions of PAN-OS: https://security.paloaltonetworks.com/CVE-2024-3400

#CVE_2024_3400 #PaloAltoNetworks #zeroday #activeexploitation #eitw #kev #KnownExploitedVulnerabilitiesCatalog #vulnerability #threatintel #IOC

CVE-2024-3400 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurat...

Palo Alto Networks Product Security Assurance
Show threadNot SimonApr 12, 2024

CISA put out an additional security alert about CVE-2024-3400, noting that Palo Alto Networks released workaround guidance for the command injection vulnerability. đź”— https://www.cisa.gov/news-events/alerts/2024/04/12/palo-alto-networks-releases-guidance-vulnerability-pan-os-cve-2024-3400

#CVE_2024_3400 #PaloAltoNetworks #zeroday #activeexploitation #eitw #kev #KnownExploitedVulnerabilitiesCatalog #vulnerability #CISA