Summary
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities.
Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications.
[1] https://security.paloaltonetworks.com/?version=10.2.2&product=PAN-OS
Vulnerabilities 8
-
High 8.6CVE-2022-0028 Exploited
PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering
A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (vi…
KEV Aug 22, 2022 -
High 8.8
PAN-OS: DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web Interface
A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web inte…
-
High 7.0
PAN-OS: File Upload Vulnerability in the Panorama Web Interface
An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panoram…
-
Medium 5.5
PAN-OS: Read System Files and Resources During Configuration Commit
A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.
-
Medium 4.9
PAN-OS: Plaintext Disclosure of External System Integration Credentials
A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web i…
-
Medium 4.4
PAN-OS: Local File Disclosure Vulnerability in the PAN-OS Web Interface
A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.
-
Medium 4.1
PAN-OS: Exposure of Sensitive Information Vulnerability
A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device configuration and encrypted API keys.
-
Low 2.1
PAN-OS: Server-Side Request Forgery in WildFire
A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible.
Revision history
-
#3
Added newly published CVE-2024-5917
-
#2
Added newly published CVE-2024-5911
-
#1
Publication Date
References
-
SSA-822518: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW Before V11.0.1 on RUGGEDCOM APE1808 Devices - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-822518.html