PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

{
  "id": "CVE-2024-3400",
  "title": "PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect",
  "type": "Vulnerability",
  "source_url": "https://www.cve.org/CVERecord?id=CVE-2024-3400",
  "snapshot": "CVE-2024-3400.json",
  "status": "PUBLISHED",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "cve_schema": "5.1",
  "published": "2024-04-12T07:20:00.707Z",
  "modified": "2025-10-21T23:05:21.315Z",
  "provider": {
    "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "shortName": "palo_alto",
    "dateUpdated": "2024-04-19T22:27:27.179Z"
  },
  "affected": [
    {
      "vendor": "Palo Alto Networks",
      "product": "PAN-OS",
      "versions": [
        {
          "status": "unaffected",
          "version": "9.0.0"
        },
        {
          "status": "unaffected",
          "version": "9.1.0"
        },
        {
          "status": "unaffected",
          "version": "10.0.0"
        },
        {
          "status": "unaffected",
          "version": "10.1.0"
        },
        {
          "changes": [
            {
              "at": "10.2.9-h1",
              "status": "unaffected"
            }
          ],
          "lessThan": "10.2.9-h1",
          "status": "affected",
          "version": "10.2.0",
          "versionType": "custom"
        },
        {
          "changes": [
            {
              "at": "11.0.4-h1",
              "status": "unaffected"
            }
          ],
          "lessThan": "11.0.4-h1",
          "status": "affected",
          "version": "11.0.0",
          "versionType": "custom"
        },
        {
          "changes": [
            {
              "at": "11.1.2-h3",
              "status": "unaffected"
            }
          ],
          "lessThan": "11.1.2-h3",
          "status": "affected",
          "version": "11.1.0",
          "versionType": "custom"
        }
      ],
      "defaultStatus": "unaffected"
    },
    {
      "vendor": "Palo Alto Networks",
      "product": "Cloud NGFW",
      "versions": [
        {
          "status": "unaffected",
          "version": "All"
        }
      ],
      "defaultStatus": "unaffected"
    },
    {
      "vendor": "Palo Alto Networks",
      "product": "Prisma Access",
      "versions": [
        {
          "status": "unaffected",
          "version": "All"
        }
      ],
      "defaultStatus": "unaffected"
    }
  ],
  "credits": [
    {
      "lang": "en",
      "value": "Palo Alto Networks thanks Volexity for detecting and identifying this issue.",
      "type": "finder"
    },
    {
      "lang": "en",
      "value": "Capability Development Group at Bishop Fox for helping us verify the fixes and improve threat prevention signatures.",
      "type": "remediation verifier"
    }
  ],
  "source_references": [
    {
      "url": "https://security.paloaltonetworks.com/CVE-2024-3400",
      "tags": [
        "vendor-advisory"
      ]
    },
    {
      "url": "https://unit42.paloaltonetworks.com/cve-2024-3400/",
      "tags": [
        "technical-description"
      ]
    },
    {
      "url": "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/",
      "tags": [
        "technical-description"
      ]
    },
    {
      "url": "https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/",
      "tags": [
        "technical-description"
      ]
    }
  ]
}