CVE-2020-2014: 
PAN-OS vulnerability analysis and mitigation

An OS Command Injection vulnerability (CVE-2020-2014) was discovered in the PAN-OS management server that allows authenticated users to inject and execute arbitrary shell commands with root privileges. The vulnerability was identified on May 13, 2020, through an internal security review by Palo Alto Networks. The issue affects all versions of PAN-OS 7.1 and 8.0, PAN-OS 8.1 versions earlier than 8.1.14, and PAN-OS 9.0 versions earlier than 9.0.7 (Palo Alto Networks).

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 (HIGH) with the following characteristics: Network Attack Vector, Low Attack Complexity, Low Privileges Required, No User Interaction needed, and High impacts on Confidentiality, Integrity, and Availability. The vulnerability is classified as CWE-78 OS Command Injection type (Palo Alto Networks).

If exploited, this vulnerability allows authenticated attackers to execute arbitrary shell commands with root privileges on the affected PAN-OS management server. This could lead to complete system compromise, potentially affecting the confidentiality, integrity, and availability of the system (Palo Alto Networks).

The vulnerability requires network access and low-level privileges for exploitation. No user interaction is needed for the exploit to be successful, making it relatively straightforward to exploit for authenticated users (Palo Alto Networks).

The vulnerability has been fixed in PAN-OS versions 8.1.14, 9.0.7, 9.1.0, and all later PAN-OS versions. For systems that cannot be immediately updated, Palo Alto Networks strongly recommends following best practices for securing the PAN-OS management interface, which can be found in their technical documentation (Palo Alto Networks).