Improper authentication in Palo Alto PAN-OS - CVE-2024-0012
Published: November 18, 2024 / Updated: June 13, 2025
Vulnerability identifier: #VU100596
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-0012
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper authentication in the Management Web Interface. A remote non-authenticated attacker can bypass authentication process and gain unauthorized access to the system.
Note, the vulnerability is being actively exploited in the wild in conjunction with #VU100528 (CVE-2024-9474).
Affected software
Palo Alto PAN-OS
RUGGEDCOM APE1808
RUGGEDCOM APE1808
How to mitigate CVE-2024-0012
Install updates from vendor's website.
Palo Alto PAN-OS - addressed in versions 10.2.12-h2, 11.0.6-h1, 11.1.5-h1, 11.2.4-h1
Links to Public Exploits and PoC-codes
- Exploit #11636 - PanOsExploitMultitool (Exploitation and Post-Exploitation Multitool for Palo Alto PAN-OS Systems affected by vulnerabilities CVE-2024-0012 and CVE-2024-9474) (June 13, 2025)
- Exploit #11174 - CVE-2024-0012-poc (February 25, 2025)
- Exploit #11123 - cve-2024-0012-gui-poc (February 7, 2025)
- Exploit #11033 - Palo Alto Networks PAN-OS Management Interface Unauthenticated Remote Code Execution (December 30, 2024)
- Exploit #10977 - cve-2024-0012-poc (December 13, 2024)
- Exploit #10950 - CVE-2024-0012 (December 6, 2024)
- Exploit #10911 - CVE-2024-0012-POC (November 22, 2024)
- Exploit #10907 - palo-alto-panos-cve-2024-0012 (November 22, 2024)
- Exploit #10906 - CVE-2024-0012 (November 22, 2024)
- Exploit #10899 - CVE-2024-0012 (Palo Alto CVE-2024-0012 Exploit POC) (November 22, 2024)