CVE-2024-3400: Command Injection Vulnerability in Palo Alto Networks PAN-OS

On April 12th, 2024, Palo Alto Networks disclosed CVE-2024-3400, a critical command injection vulnerability in PAN-OS software versions 10.2, 11.0, and 11.1, allowing unauthenticated attackers to run arbitrary code with root privileges on affected firewalls when GlobalProtect gateway and device telemetry are active.

alto april arbitrary code attackers code command command injection critical cve cve-2024 cve-2024-3400 device firewalls gateway globalprotect injection networks palo palo alto palo alto networks palo alto networks pan-os pan pan-os privileges root run software telemetry unauthenticated vulnerability