Exploit for CVE-2024-3400

cve · 2024-04-12

Description

Command injection in GlobalProtect feature of Palo Alto Networks PAN-O

Entry point

ParameterSESSID (cookie) · path

Pathglobal-protect/portal/fonts/glyphicons-abcdefgh-regular.woff2

Unauthenticated arbitrary file write via cookie-based path traversal leading to font file creation in global-protect portal fonts directory.

Affected Paloaltonetworks Pan-os versions

Paloaltonetworks Pan-os= 10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.2.5, 10.2.6, 10.2.7, 10.2.8, 10.2.9, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.1.0, 11.1.1, 11.1.2

All known vulnerabilities by product

Pan-Os

CVSS 10.0 for CVE-2024-3400

10.0

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

100.0%higher than 100.0% of all CVEs

Updated 2026-08-05

CVE Information

CVE-2024-3400

References

https://security.paloaltonetworks.com/CVE-2024-3400

https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/

https://unit42.paloaltonetworks.com/cve-2024-3400/

https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400

Exploit Details

Modified:2026-06-17 07:44

Last Seen:2026-07-15 10:31

Reporter:palo_alto

Other exploits for CVE-2024-3400

Exploit for Command Injection in Paloaltonetworks Pan-Os

2026-07-24 razureinkGITHUB

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

2026-05-30 Nikki-the-ParcelGITHUB

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

2026-05-30 Nikki-the-ParcelGITHUB

CTT-enhanced-Dirty-Frag-exploit

2026-05-08 SimoesCTTGITHUB

Exploit for Command Injection in Paloaltonetworks Pan-Os

2026-04-20 wa6n3rGITHUB

Exploit for Command Injection in Paloaltonetworks Pan-Os

2026-04-06 SimoesCTTGITHUB

Exploit for Command Injection in Paloaltonetworks Pan-Os

2026-03-30 xiexie-qiuligaoGITHUB

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

2025-06-08 CyberBibsGITHUB

Exploit Code

MARKDOWN4 lines

## https://sploitus.com/exploit?id=CVE-2024-3400
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Exploit Code

Share

Share on social media: