CVE-2024-3400
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configu...
Affects 1 product across 2 vendors.
Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.
Attacker injects operating system commands through application inputs passed to a shell or system call.
Show all 57
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Successful exploitation could lead to full control of the firewall, potentially disrupting network segmentation and allowing unauthorized access to critical industrial control systems. Organizations using affected PAN-OS versions in their OT networks are at significant risk.
BSID: BS-2024-GLOBAL-037060-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2024-3400?
What is the CVSS score for CVE-2024-3400?
Is CVE-2024-3400 actively exploited?
How do I remediate CVE-2024-3400?
What systems are affected by CVE-2024-3400?
What NERC-CIP standard applies to CVE-2024-3400?
What IEC 62443 requirement maps to CVE-2024-3400?
| CVE ID | CVE-2024-3400 |
|---|---|
| BSID | BS-2024-GLOBAL-037060-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2024-04-12 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 80% |
| Weakness (CWE) | |
| Verticals | |
| Domains | |
| Source | NVD |
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
Source: NIST NVD / MITRE CVE Database
The vulnerability exists in the GlobalProtect feature of PAN-OS, which handles incoming connections to the firewall. An unauthenticated attacker can send a specially crafted HTTP request to the GlobalProtect endpoint, leading to arbitrary file creation and subsequent command injection. The attacker does not need any credentials and can exploit this vulnerability from anywhere on the network. Once exploited, the attacker gains root-level access to the firewall, enabling them to modify firewall rules, intercept traffic, and potentially disrupt communication between industrial devices. This can lead to unauthorized control of the industrial process, including potential safety system manipulation.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Palo Alto Networks | Pan-Os | 10.2.0 10.2.1 10.2.2 10.2.3 10.2.4 10.2.5+12 more10.2.6 10.2.7 10.2.8 10.2.9 11.0.0 11.0.1 11.0.2 11.0.3 11.0.4 11.1.0 11.1.1 11.1.2 |
| Siemens | — | — |
| CISA known-exploited | ● Active Exploitation Confirmed (added 2024-04-12) |
|---|---|
| Public Exploit | ⚠ Available — Reference |
| PoC Code | Not confirmed |
Implement strict network segmentation to isolate the firewall from the OT network. Use ACLs to restrict access to the GlobalProtect endpoint to trusted IP addresses only. Enable logging and monitoring for suspicious activity on the firewall. Consider deploying a secondary firewall or proxy to filter traffic to the GlobalProtect endpoint.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
CIP-007-R1 requires identification and disabling of unnecessary ports and services. The vulnerable GlobalProtect feature represents an unnecessary service on BES Cyber Assets if remote access is not required.
IEC 62443 SR 3.5 (Input Validation) is directly violated. The firmware fails to validate the filename parameter length before processing, enabling arbitrary file creation and command injection.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-23 |
| SHA-512 Audit Hash | c7e1ffa1d731ea92054680c954103f06bad834b0e8c0ed3334275842141e972ede3397eba8afc65b9acc2061e5d502855179ff123fd8fa5b7212034fc67010d1 |
This Vulnerability Is Being Actively Exploited
CVE-2024-3400 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →