Unathorized Access to GlobalProtect Service through Null Pointer Dereference Vulnerability
CVE-2024-2550

7.5HIGH

Key Information:

Vendor: Palo Alto Networks
Status: Cloud Ngfw; Pan-os; Prisma Access
Vendor: CVE Published:; 14 November 2024

🔔 Create Palo Alto Networks Vulnerability Alert

What is CVE-2024-2550?

A null pointer dereference vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS allows unauthenticated individuals to execute a denial of service (DoS) attack. This is achieved by sending specifically crafted packets that can cause the GlobalProtect service to fail. The repeated initiation of this attack can lead to the firewall entering maintenance mode, disrupting network services and necessitating administrative intervention.

Affected Version(s)

PAN-OS 11.1.0 < 11.1.5

PAN-OS 11.0.0 < 11.0.6

PAN-OS 10.2.0 < 10.2.11

References

https://security.paloaltonetworks.com/CVE-2024-2550

vendor-advisory

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 14, 2024
Vulnerability Reserved
Mar 15, 2024

Credit

Michael Baker from AC3