What is CVE-2024-0012?
On 18 November 2024 Palo Alto Networks disclosed a critical flaw in the PAN‑OS web‑based management interface. The vulnerability allows an unauthenticated attacker to bypass the login process and gain administrative access to the device. It affects firewalls, VPN concentrators and any other PAN‑OS appliance that presents the same management UI.
We keep a daily-updated list of vulnerabilities CISA has confirmed as actively exploited, including remediation deadlines.
Who should be reading this?
If you run a Palo Alto Networks firewall, a PA‑Series appliance, or a VM‑Series virtual firewall, you need to be here. If you manage a remote site that uses a PAN‑OS device, you also need to know what to do. The issue is not limited to a specific model – it is a problem with the PAN‑OS code base itself.
Is your device vulnerable?
The National Vulnerability Database does not publish a list of affected or fixed releases. That information will appear in the table below, which is generated automatically from NVD data. Your first step is to compare the PAN‑OS version you are running with the entries in that table. If your version appears in the “affected” column, you are vulnerable.
Even if the version is not listed, you should still verify that the management interface is not exposed to the internet. The vulnerability can be exploited remotely, so any external reachability is a red flag.
How severe is the problem?
The CVSS base score is 9.8 – a critical rating. An attacker who succeeds gains full control of the firewall, can read or modify all traffic logs, change security policies, and even pivot to internal networks. The United States Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-0012 to its Known Exploited Vulnerabilities catalog on the day it was published. CISA also notes that ransomware groups have already used this flaw as an entry point for encrypting data.
In short, the risk is extremely high. You cannot afford to treat this as a low‑priority ticket.
How does the flaw work?
The NVD description is brief: an authentication bypass in the web‑based management interface. The exact technical details have not been released publicly. What we do know is that the flaw belongs to the class of authentication bypass vulnerabilities, where the software fails to properly validate a credential or session token before granting access.
In practice this means an attacker can craft a request that the PAN‑OS UI accepts as a valid login, even though no legitimate credentials were supplied. Because the UI runs on the management plane, the attacker is immediately placed in a privileged context.
Because Palo Alto Networks has not disclosed the precise code path, we cannot provide a step‑by‑step exploit narrative. The important point is that the weakness is on the management side, not in the data‑plane forwarding engine.
How to determine if you are exposed
Follow these three checks. All of them can be run from a workstation that has network reach to the firewall’s management address.
- Check the PAN‑OS version. Log in to the web UI (if you can) and note the version string at the bottom of the dashboard. Alternatively, use the CLI:
show system info | match Version - Verify that the management interface is not reachable from the internet. From an external host, run:
curl -k -s -o /dev/null -w "%{http_code}" https://firewall‑mgmt‑ip/
If you get a200or401response, the UI is reachable. If you see a timeout or connection refused, it is blocked. - Confirm that remote management is disabled on untrusted zones. In the CLI run:
show running configuration | match management-interface
Look for any statements that bind the management port to a zone that includes untrusted networks.
If any of these checks raise a concern, treat the device as exposed.
Mitigation and remediation
The vendor’s official guidance is simple: apply the patch that addresses CVE-2024-0012, or upgrade to the patched release for your branch. The exact release numbers are listed in the table below – do not guess. Use the following commands to install the update.
- Download the appropriate software package from the Palo Alto Networks support portal.
- Upload it to the firewall, for example with SCP:
scp panos‑update.tgz admin@firewall‑mgmt‑ip:/var/tmp/ - From the CLI, install the package:
request system software install file /var/tmp/panos‑update.tgz - After the install completes, reboot the appliance to activate the new code:
request restart system
While the upgrade is in progress, you should tighten network controls. Block all inbound traffic to the management IP at the perimeter firewall, and only allow connections from a known, hardened jump host.
Once the patched version is running, re‑run the version check to confirm you are on a non‑vulnerable release. Then test the management UI from an internal host to ensure it still works as expected.
What if a patch isn’t available yet?
In the unlikely event that the table below shows no patched release for your branch, you must treat the device as unpatched. Follow these emergency steps:
- Isolate the management interface. Create an ACL on any upstream router or firewall that blocks TCP port 443 (HTTPS) and TCP port 80 (HTTP) to the device’s management IP from any source outside your trusted network.
- Disable remote management services. From the CLI run:
configureset deviceconfig setting management https disabled yescommit - Enable two‑factor authentication for any remaining local logins. If you have a RADIUS or LDAP backend, enforce MFA at that level.
- Monitor logs for suspicious activity. Look for any successful logins from unknown IPs:
show log system | match "login"
These measures do not remove the flaw, but they dramatically reduce the chance of an attacker reaching it. Keep an eye on the Palo Alto Networks security advisory page – a patched release will appear as soon as it is ready.
Summary
CVE-2024-0012 is a critical authentication bypass in PAN‑OS management UI, already seen in ransomware attacks. If you run any Palo Alto Networks firewall or VPN concentrator, you are in scope. Check your version, block external access to the management port, and apply the vendor‑supplied patch immediately. If a patch is not yet available, isolate the interface, disable remote management, and enforce strong authentication.
All version‑specific information is captured in the table below. Use it to verify that you are on a patched release and to identify any remaining vulnerable builds.
Affected versions
NVD has not published machine-readable version ranges for CVE-2024-0012 yet. Check the vendor advisory for the exact affected and fixed releases before you plan an upgrade.
