CVE-2017-15944

Palo Alto Networks PAN-OS contains a critical remote code execution flaw, driven by improper input validation and memory-safety weaknesses (CWE-20, CWE-119), that is reachable through the firewall's management interface. An unauthenticated remote attacker can trigger the flaw via crafted requests to the management interface, and successful exploitation grants the ability to execute arbitrary code with high impact on confidentiality, integrity, and availability (CVSS 3.1: 9.8). Only PAN-OS firewalls whose management interface is reachable from untrusted networks, such as the internet, are practically exploitable. Organizations running PAN-OS before the fixed releases (6.1.19, 7.0.19, 7.1.14, 8.0.6) are affected. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-08-18, carries a 98.3% EPSS probability of exploitation within 30 days, and public proof-of-concept exploits are available on Exploit-DB.

What to do: Upgrade PAN-OS to 6.1.19 or later (6.1.x), 7.0.19 or later (7.0.x), 7.1.14 or later (7.1.x), or 8.0.6 or later (8.0.x) per vendor instructions. Until patched, restrict access to the management interface to trusted administrative networks only and verify it is not exposed to the internet. Review logs for suspicious activity against the management interface, since this flaw is listed in CISA's KEV catalog and is being actively exploited.