CVE-2021-3060
Summary
| CVE | CVE-2021-3060 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-11-10 17:15:00 UTC |
| Updated | 2021-11-15 13:16:00 UTC |
| Description | An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root user privileges. The attacker must have network access to the GlobalProtect interfaces to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers with Prisma Access 2.1 Preferred and Prisma Access 2.1 Innovation firewalls are impacted by this issue. |
Risk And Classification
Problem Types: CWE-78
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Paloaltonetworks | Pan-os | All | All | All | All |
| Operating System | Paloaltonetworks | Pan-os | All | All | All | All |
| Operating System | Paloaltonetworks | Pan-os | All | All | All | All |
| Operating System | Paloaltonetworks | Pan-os | All | All | All | All |
| Application | Paloaltonetworks | Prisma Access | 2.1 | All | All | All |
| Application | Paloaltonetworks | Prisma Access | 2.1 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Configure the Master Key | CONFIRM | docs.paloaltonetworks.com | |
| Set Up Prisma Access | CONFIRM | docs.paloaltonetworks.com | |
| CVE-2021-3060 PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP) | CONFIRM | security.paloaltonetworks.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Palo Alto Networks thanks CJ, an external security researcher, for discovering and reporting this issue.
Legacy QID Mappings
- 730283 Palo Alto Networks (PAN-OS) OS Command Injection in Simple Certificate Enrollment Protocol (SCEP) Vulnerability (PAN-176661)