CVE-2020-2007: 
PAN-OS vulnerability analysis and mitigation

An OS command injection vulnerability was discovered in the management server component of PAN-OS (CVE-2020-2007). The vulnerability, discovered internally by Jin Chen of Palo Alto Networks, was disclosed on May 13, 2020. This security flaw affects multiple versions of PAN-OS including all PAN-OS 7.1 and 8.0 versions, PAN-OS 8.1 versions earlier than 8.1.14, and PAN-OS 9.0 versions earlier than 9.0.7 (Palo Alto Advisory).

The vulnerability is classified as an OS Command Injection (CWE-78) that allows an authenticated user to potentially execute arbitrary commands with root privileges. The severity is rated as HIGH with a CVSSv3.1 Base Score of 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The attack vector is network-based with low attack complexity, though it requires high privileges and no user interaction (Palo Alto Advisory).

If exploited, this vulnerability could lead to complete system compromise due to the ability to execute arbitrary commands with root privileges. The CVSS scoring indicates high impacts on confidentiality, integrity, and availability of the affected systems (Palo Alto Advisory).

The vulnerability requires an authenticated user with high privileges to exploit, making it somewhat limited in terms of immediate exploitability. The attack complexity is rated as low, indicating that once an attacker has the required privileges, the exploitation is straightforward (Palo Alto Advisory).

Palo Alto Networks has released fixes in PAN-OS 9.0.7 and later PAN-OS 9.0 versions, as well as PAN-OS 8.1.14 and later PAN-OS 8.1 versions. For systems that cannot be immediately updated, Palo Alto Networks recommends following best practices for securing the PAN-OS management interface. PAN-OS 8.0 is end-of-life and no longer covered by Product Security Assurance policies, while PAN-OS 7.1 is on extended support until June 30, 2020 (Palo Alto Advisory).