CVE-2020-2040: 
PAN-OS vulnerability analysis and mitigation

A critical buffer overflow vulnerability (CVE-2020-2040) was discovered in PAN-OS that affects systems with enabled Captive Portal or Multi-Factor Authentication (MFA) features. The vulnerability was disclosed on September 9, 2020, affecting multiple versions of PAN-OS including all versions of PAN-OS 8.0, versions earlier than 8.1.15 in PAN-OS 8.1, versions earlier than 9.0.9 in PAN-OS 9.0, and versions earlier than 9.1.3 in PAN-OS 9.1. The vulnerability does not impact PAN-OS 10.0 or the GlobalProtect VPN and PAN-OS management web interfaces (PAN Advisory).

The vulnerability has been assigned a Critical severity with a CVSSv3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The buffer overflow vulnerability allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. The vulnerability is classified as CWE-120 Buffer Overflow (PAN Advisory).

If successfully exploited, the vulnerability allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges. This could lead to complete system compromise, affecting the confidentiality, integrity, and availability of the affected PAN-OS device (PAN Advisory, Tenable Blog).

The vulnerability was discovered during an internal security review by Yamata Li of Palo Alto Networks. As of the disclosure date, Palo Alto Networks was not aware of any malicious attempts to exploit this vulnerability in the wild (PAN Advisory).

Palo Alto Networks has released fixes for this vulnerability in PAN-OS versions 8.1.15, 9.0.9, 9.1.3, and all later versions. All Prisma Access services have been upgraded to resolve this issue. For systems that cannot be immediately upgraded, enabling signatures in content update version 8317 will block attacks against CVE-2020-2040. PAN-OS 7.1 and 8.0 are end-of-life and are no longer covered by Product Security Assurance policies (PAN Advisory).

A Shodan search revealed over 14,000 PAN-OS devices that were publicly accessible at the time of disclosure, though it was unclear how many of these devices were vulnerable. This vulnerability marked the second critical vulnerability in PAN-OS devices that had been patched in three months, following CVE-2020-2021 which was disclosed in July with a CVSSv3 score of 10.0 (Tenable Blog).