CVE-2024-3400

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 1.000 · 100 %ileexploit · weaponizedDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 47 exploits · weaponized

Likely / severe?

100.0% (100th) EPSS

CVSS 10 · critical

Is it mine?

27 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

added 2024-04-12remediate by 2024-04-19

required action Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

EPSS · scored 2026-10-27

Palo Alto Networks PAN-OS Command Injection Vulnerability

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRUGGEDCOM APE1808siemens_psirt
Upgrade Palo Alto Networks Virtual NGFW V11.1.2-h3. Contact customer support to receive patch and update information.
FixedRUGGEDCOM APE1808cisa_csaf_ot
Upgrade Palo Alto Networks Virtual NGFW V11.1.2-h3. Contact customer support to receive patch and update information.
MitigationRUGGEDCOM APE1808siemens_psirt
Customers with a Threat Prevention subscription can block attacks for this vulnerability using Threat IDs 95187, 95189, and 95191 (available in Applications and Threats content version 8836-8695 and later). For further instruction see Palo Alto Network's upstream notification (https://security.paloaltonetworks.com/CVE-2024-3400)
MitigationRUGGEDCOM APE1808cisa_csaf_ot
Customers with a Threat Prevention subscription can block attacks for this vulnerability using Threat IDs 95187, 95189, and 95191 (available in Applications and Threats content version 8836-8695 and later). For further instruction see Palo Alto Network's upstream notification (https://security.paloaltonetworks.com/CVE-2024-3400)

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 6

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:T/RC:Csecondary · CISA US

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · psirt@paloaltonetworks.comexploitability 3.9 · impact 6

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:T/RC:Csecondary · Siemens ProductCERT DE

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-77USprimaryCWE-20USCWE-77USCWE-77USCWE-77US

exploits (47)

Public proof-of-concept and weaponised exploit code.

exploit/linux/http/panos_telemetry_cmd_execPalo Alto Networks PAN-OS Unauthenticated Remote Code Executionweaponized · metasploit
EDB-51996Palo Alto PAN-OS < v11.1.2-h3 - Command Injection and Arbitrary File CreationPoC · exploit_db
0x0d3ad/CVE-2024-3400CVE-2024-3400PoC · poc_in_github
0xr2r/CVE-2024-3400-Palo-Alto-OS-Command-Injection0xr2r/CVE-2024-3400-Palo-Alto-OS-Command-InjectionPoC · poc_in_github
AdaniKamal/CVE-2024-3400CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtectPoC · poc_in_github
CONDITIONBLACK/CVE-2024-3400-POCCONDITIONBLACK/CVE-2024-3400-POCPoC · poc_in_github

affected products (27)

Products and version ranges known to be affected.

RUGGEDCOM APE1808all versionscisa_csaf_otUS
Siemens RUGGEDCOM APE1808≤ All_versions_with_Palo_Alto_Networks_Virtual_NGFW_configured_with_GlobalProtect_gateway_or_GlobalProtect_portal_(or_both).cisa_csaf_otUS
Palo Alto Networks PAN-OS10.2.0 → 10.2.9-h1enisa_euvdEU
Palo Alto Networks PAN-OS11.0.0 → 11.0.4-h1enisa_euvdEU
Palo Alto Networks PAN-OS11.1.0 → 11.1.2-h3enisa_euvdEU
Palo Alto Networks Inc. PAN-OS10.2 → 10.2.9-h1fstec_bduRU
Palo Alto Networks Inc. PAN-OS11.0 → 11.0.4-h1fstec_bduRU
Palo Alto Networks Inc. PAN-OS11.1 → 11.1.2-h3fstec_bduRU
paloaltonetworks pan-os= 10.2.0nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks pan-os= 10.2.1nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks pan-os= 10.2.2nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks pan-os= 10.2.3nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks pan-os= 10.2.4nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks pan-os= 10.2.5nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks pan-os= 10.2.6nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks pan-os= 10.2.7nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks pan-os= 10.2.8nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks pan-os= 10.2.9nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks pan-os= 11.0.0nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks pan-os= 11.0.1nvdUScpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

showing 20 of 27

advisories (3)

Vendor and ecosystem advisories describing this.

SSA-750274SSA-750274: Impact of CVE-2024-3400 on RUGGEDCOM APE1808 devices configured with Palo Alto Networks Virtual NGFW2024-04-19csaf · siemens_psirtDE
Palo Alto Networks has published [1] information on CVE-2024-3400 in PAN-OS. This advisory addresses Siemens Industrial products affected by this vulnerability. Siemens has released a new version of Palo Alto Networks Virtual NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. [1] https://security.paloaltonetworks.com/CVE-2024-3400
WID-SEC-W-2024-0878PaloAlto Networks PAN-OS: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit AdministratorrechtenDeutsch2024-04-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in PaloAlto Networks PAN-OS ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.
ICSA-24-116-03Siemens RUGGEDCOM APE1808 devices configured with Palo Alto Networks Virtual NGFW2024-04-19icsa · cisa_csaf_otUS
Palo Alto Networks has published [1] information on CVE-2024-3400 in PAN-OS. This advisory addresses Siemens Industrial products affected by this vulnerability. Siemens has released a new version of Palo Alto Networks Virtual NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. [1] https://security.paloaltonetworks.com/CVE-2024-3400

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd siemens_psirt cert_bund NVD CVE.org MITRE

published 2024-04-12modified 2026-06-17

related (4,599)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-96951US	high8.8OT critical	9.81% (96th)	KEV	2026-10-13
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-105134US	critical10.0OT critical	81.8% (100th)	KEV	2026-10-04
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication…
CVE-2026-8037US	critical9.8OT critical	99.8% (100th)	KEV	2026-06-04
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster applian…
CVE-2026-42271US	high8.8OT critical	91.4% (100th)	KEV	2026-05-08
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server befo…
CVE-2026-22719US	—OT critical	18.3% (97th)	KEV	2026-02-25
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote c…

+4594 more

references (16)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan