CVE-2024-0012: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

What it is

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Description quoted from the CVE record (assigned by palo_alto, published 2024-11-18).

Weakness: CWE-306 Missing Authentication for Critical Function

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red

CISA assessment (SSVC): CISA assesses exploitation as active. Automatable: yes. Technical impact: total.

On CISA KEV since

2024-11-18

US federal deadline

2024-12-09

Ransomware use

Yes

Public exploit evidence (Exploit Observer)

Exploit Observer evidence for this CVE has not been fetched yet.

Live scores

EPSS

0.998
very likely to be attacked soon

VEDAS

0.980
strong exploit evidence

On CISA KEV

Yes, since 2024-11-18

Detection rule

Nuclei · Suricata

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Who is affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Fixed versions stated in the CVE record: 11.2.4-h1, 11.1.5-h1, 11.0.6-h1, 10.2.12-h2.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.

Vendor guidance:

• https://security.paloaltonetworks.com/CVE-2024-0012 (vendor-advisory)

How to detect it

Nuclei template (active check)

Paloalto - Missing Authentication

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 .

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /php/ztp_gate.php/.js.map); it decides using dsl matchers. Severity in the template: critical. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

nuclei -u https://your-host -t CVE-2024-0012.yaml

id: CVE-2024-0012

info:
  name: "Paloalto - Missing Authentication"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with
    network access to the management web interface to gain PAN-OS administrator privileges to perform
    administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation
    vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 .
  reference:
    - https://www.exploit.observer/?keyword=CVE-2024-0012&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=paloalto&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-0012
    cwe-id: CWE-306
  metadata:
    verified: false
  tags: cve,cve2024,paloalto,globalprotect,kev,vkev,vuln
http:
  - raw:
      - |
        GET /php/ztp_gate.php/.js.map HTTP/1.1
        Host: {{Hostname}}
        X-PAN-AUTHCHECK: off

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body, "<title>Zero Touch Provisioning", "Zero Touch Provisioning (ZTP)")'
          - 'contains(body, "/scripts/cache/mainui.javascript")'
          - 'contains(header, "PHPSESSID=")'
          - 'status_code == 200'
        condition: and

CVE-2024-0012.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2024-0012 Paloalto - Missing Authentication. Add them to your Suricata rule set and reload.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2024-0012 Paloalto - Missing Authentication"; flow:established,to_server; http.uri; content:"/php/ztp_gate.php/.js.map"; nocase; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2024-0012; reference:url,https://www.exploit.observer/?keyword=CVE-2024-0012&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=paloalto&match=exact; sid:1009546; rev:1;)

CVE-2024-0012.rules on GitHub

Advisories on this CVE

• Indian BFSI sector (India): CERT-In/CSIRT-Fin observe exploitation campaign against Palo Alto firewalls (1 Dec 2025)

References

Vendor advisories and patches

• https://security.paloaltonetworks.com/CVE-2024-0012 (vendor-advisory)

Government sources

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-0012 (government-resource)

Other references

• https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/
• https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

Other databases

• CVE record (cve.org)
• NVD
• Exploit Observer

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, CISA KEV, cve-scores (EPSS and VEDAS), vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.