CVE-2020-2041: 
PAN-OS vulnerability analysis and mitigation

CVE-2020-2041 is a denial-of-service vulnerability in the management web interface of Palo Alto Networks PAN-OS. The vulnerability was discovered internally by Nicholas Newsom of Palo Alto Networks and disclosed on September 9, 2020. It affects PAN-OS 8.0 and PAN-OS 8.1 versions earlier than 8.1.16 (Palo Alto Networks).

The vulnerability stems from an insecure configuration of the appweb daemon in PAN-OS 8.1. The vulnerability has a CVSS v3.1 Base Score of 7.5 (HIGH) with the following metrics: Attack Vector: NETWORK, Attack Complexity: LOW, Privileges Required: NONE, User Interaction: NONE, Scope: UNCHANGED, Confidentiality Impact: NONE, Integrity Impact: NONE, Availability Impact: HIGH. The weakness type is identified as CWE-16 Configuration (Palo Alto Networks).

A remote unauthenticated user can send a specifically crafted request to the device that causes the appweb service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode (Palo Alto Networks).

Palo Alto Networks has reported that they are not aware of any malicious attempts to exploit this vulnerability in the wild (Palo Alto Networks).

The vulnerability has been fixed in PAN-OS 8.1.16 and all later PAN-OS versions. For systems that cannot be immediately updated, Palo Alto Networks recommends following best practices for securing the PAN-OS management web interface by reviewing the Best Practices for Securing Administrative Access in the PAN-OS technical documentation (Palo Alto Networks).