Palo Alto Networks PAN-OS CVE-2024-0012 management web interface authentication bypass (CISA KEV, exploited with CVE-2024-9474): which versions are fixed and how do I lock down the management interface?

What it is: CVE-2024-0012 (advisory PAN-SA-2024-0015, published 2024-11-18) is a missing-authentication flaw in the PAN-OS management web interface. An unauthenticated attacker with network access to that interface can gain PAN-OS administrator privileges, change the configuration, or chain into other privilege escalation flaws such as CVE-2024-9474. Palo Alto Networks rated it critical (CVSS-BT 9.3) and reported increasing attacks. CISA added it to the KEV catalog on 2024-11-18 with known ransomware use. The risk is greatly reduced if the management interface is reachable only from trusted internal addresses. Am I affected: - PAN-OS 10.2, 11.0, 11.1 and 11.2 on PA-Series, VM-Series, CN-Series firewalls and Panorama. PAN-OS 10.1, Cloud NGFW and Prisma Access are not impacted. - Exposure applies when the management interface is reachable from the internet or other untrusted networks, directly or through a dataplane interface with a management profile. GlobalProtect portals and gateways are not themselves vulnerable, but a management profile on such an interface exposes the management web interface. - Fixed versions: PAN-OS 10.2.12-h2, 11.0.6-h1, 11.1.5-h1, 11.2.4-h1 and later. Palo Alto also lists hotfixes on commonly deployed maintenance releases, for example 10.2.7-h18, 10.2.9-h16, 11.1.2-h15, 11.1.4-h7 and 11.2.3-h3; check the advisory table for your exact release. Fix: 1. Restrict management access to a small set of trusted internal IP addresses (a jump host is best), turn off the management profile on internet-facing interfaces, and follow Palo Alto's best-practice deployment guide for securing management access. This is the vendor's primary recommendation. 2. Upgrade to a fixed version or hotfix for your release train. 3. Customers with a Threat Prevention subscription can additionally use the Threat IDs listed in the advisory (content version 8915-9075 or later), which requires block mode and inspection of inbound management traffic as the advisory describes. 4. If the management interface was exposed before the fix, treat the device as possibly compromised: review configuration change logs and admin accounts for changes you did not make, check system logs for unexpected management logins, new users or commit activity, and contact Palo Alto Networks support for a technical support file review. Rebuild or factory reset if indicated, restore a verified-clean configuration, and rotate administrator passwords, API keys, certificates and private keys, VPN and LDAP/SAML credentials. Verify: the PAN-OS version is at or above the fixed release, and an external scan shows no reachable management web interface. In the Customer Support Portal, the Assets > Remediation Required view no longer lists the device. Sources: https://security.paloaltonetworks.com/CVE-2024-0012 https://nvd.nist.gov/vuln/detail/CVE-2024-0012 https://www.cisa.gov/known-exploited-vulnerabilities-catalog