Difficult-to-exploit privilege escalation vulnerability in Palo Alto Networks Cortex XDR agent on Windows devices
CVE-2024-5907

5.2MEDIUM

Key Information:

Vendor

Palo Alto Networks
Status
Cortex Xdr Agent
Vendor
CVE Published:
12 June 2024

Badges

👾 Exploit Exists

What is CVE-2024-5907?

The vulnerability enables local users to escalate privileges on Windows devices running Palo Alto Networks Cortex XDR agent. By exploiting a race condition, an attacker can execute programs with elevated rights, potentially compromising the system's integrity and data security. While the nature of the exploit makes it challenging to achieve, the existence of this vulnerability underscores the importance of timely updates and patches to safeguard systems against potential threats.

Affected Version(s)

Cortex XDR Agent Windows 7.9-CE < 7.9.102-CE

Cortex XDR Agent Windows 8.1.0

Cortex XDR Agent Windows 8.2.0 < 8.2.3

References

https://security.paloaltonetworks.com/CVE-2024-5907
vendor-advisory

CVSS V4

Score:
5.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

Credit

Palo Alto Networks thanks Orange Cyberdefense Switzerland's Research Team for discovering and reporting this issue.
.