Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2021-3064 EUVD-2021-26416GHSA-4753-h47c-jrw3

PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces

Published Nov 10, 2021 · Updated Sep 17, 2024 · Assigned by palo_alto

Vendor: Palo Alto Networks Product: PAN-OS Product: Prisma Access Category: Network devices

Description

A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attacker must have network access to the GlobalProtect interface to exploit this issue. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.17. Prisma Access customers are not impacted by this issue.

Affected products

VendorProductAffectedFixed
Palo Alto Networks PAN-OS 8.1 – < 8.1.17 9.0.*
Palo Alto Networks Prisma Access — 2.2 all

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • 0xhaggis/CVE-2021-3064 ★ 1 · Apr 26, 2022

    Exploit for CVE-2021-3036, HTTP Smuggling + buffer overflow in PanOS 8.x

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References