CVE-2020-2009: 
PAN-OS vulnerability analysis and mitigation

An external control of filename vulnerability (CVE-2020-2009) was discovered in the SD WAN component of Palo Alto Networks PAN-OS Panorama. The vulnerability was internally discovered by Nicholas Newsom and Jin Chen of Palo Alto Networks and was publicly disclosed on May 13, 2020. This vulnerability affects all versions of PAN-OS 7.1 and 8.0, PAN-OS 8.1 versions earlier than 8.1.14, and PAN-OS 9.0 versions earlier than 9.0.7 (Palo Alto Advisory).

The vulnerability allows an authenticated administrator to send a request that results in the creation and write of an arbitrary file on all firewalls managed by the Panorama. The vulnerability is classified as CWE-73 (External Control of File Name or Path). It has received a CVSSv3.1 Base Score of 7.2 (HIGH), with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: High, User Interaction: None, Scope: Unchanged, Confidentiality Impact: High, Integrity Impact: High, Availability Impact: High (Palo Alto Advisory).

In some cases, this vulnerability can result in arbitrary code execution with root permissions on affected systems. The vulnerability affects the management interface of PAN-OS and could potentially compromise all firewalls managed by the Panorama system (Palo Alto Advisory).

The vulnerability requires an authenticated administrator account to exploit, which somewhat limits its potential for widespread abuse. However, if successfully exploited, it could lead to significant system compromise due to the potential for arbitrary code execution with root permissions (Palo Alto Advisory).

The vulnerability has been fixed in PAN-OS 8.1.14, PAN-OS 9.0.7, and all later PAN-OS versions. For systems that cannot be immediately updated, Palo Alto Networks recommends following best practices for securing the PAN-OS management interface. It's worth noting that PAN-OS 8.0 is end-of-life as of October 31, 2019, and PAN-OS 7.1 is on extended support until June 30, 2020, only receiving critical security vulnerability fixes (Palo Alto Advisory).