# CVE-2024-9474

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

- Page: https://www.vulneraibility.com/cve/CVE-2024-9474
- CVSS: 7.2
- Known exploited: yes, in CISA KEV since 2024-11-18; CISA due date 2024-12-09; known ransomware use
- EPSS: 93.77%
- Public exploit code: 1 Metasploit module · 5 GitHub proofs of concept · 1 Nuclei template (first 2024-11-19)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2024-11-18)
- Weakness: CWE-78
- Published: 2024-11-18

## Affected versions

- Palo Alto Networks PAN-OS: affected >= 11.2.0 and < 11.2.4-h1; >= 11.1.0 and < 11.1.5-h1; >= 11.0.0 and < 11.0.6-h1; >= 10.2.0 and < 10.2.12-h2; >= 10.1.0 and < 10.1.14-h6

A version outside these ranges is not a statement that it is unaffected.

## References

- [advisory] https://security.paloaltonetworks.com/CVE-2024-9474
- [other] https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/
- [exploit] https://github.com/k4nfr3/CVE-2024-9474
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9474
- [other] https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.