CVE-2020-2037: 
PAN-OS vulnerability analysis and mitigation

CVE-2020-2037 is an OS Command Injection vulnerability discovered in the PAN-OS management interface. The vulnerability was disclosed on September 9, 2020, affecting multiple versions of PAN-OS including versions 8.1 (earlier than 8.1.16), 9.0 (earlier than 9.0.10), and 9.1 (earlier than 9.1.3). This security flaw allows authenticated administrators to execute arbitrary OS commands with root privileges (Palo Alto Networks).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.2 (HIGH) with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: High, User Interaction: None, Scope: Unchanged, Confidentiality Impact: High, Integrity Impact: High, Availability Impact: High. The vulnerability is classified as CWE-78 (OS Command Injection) (Palo Alto Networks).

If exploited, this vulnerability allows authenticated administrators to execute arbitrary OS commands with root privileges on the affected system. This could lead to complete system compromise, potentially affecting system confidentiality, integrity, and availability (Palo Alto Networks).

Palo Alto Networks has reported that while they are not aware of any malicious attempts to exploit this vulnerability in the wild, they acknowledge the existence of publicly available information that may help construct proof of concept exploits (Palo Alto Networks).

The vulnerability has been fixed in PAN-OS versions 8.1.16, 9.0.10, 9.1.3, and all later versions. As a temporary mitigation, administrators can enable signatures for Unique Threat ID 59971 on traffic destined for the GlobalProtect portal, gateway, or VPN to block potential attacks. Additionally, following best practices for securing the PAN-OS management web interface is recommended (Palo Alto Networks).