CVE-2024-3387: 
PAN-OS vulnerability analysis and mitigation

A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. This vulnerability, identified as CVE-2024-3387, was discovered in production use and disclosed on April 10, 2024. The issue affects specific versions of PAN-OS running on Panorama, including versions prior to 10.1.12, 10.2.7-h3/10.2.8, and 11.0.4 (Palo Security Advisory).

The vulnerability stems from inadequate encryption strength (CWE-326) in the device certificate used by Panorama software. The issue has been assigned a CVSS v3.1 base score of 5.3 MEDIUM with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. The vulnerability specifically impacts the encrypted communication channel between the Panorama management server and managed firewalls (NVD Database, Palo Security Advisory).

With sufficient computing resources, an attacker could break the encrypted communication and expose sensitive information that is shared between the Panorama management server and the firewalls it manages. The vulnerability primarily affects the confidentiality of the communication channel, with no direct impact on system integrity or availability (Palo Security Advisory).

The vulnerability requires network access and high attack complexity to exploit. As of the disclosure date, Palo Alto Networks is not aware of any malicious exploitation of this issue in the wild (Palo Security Advisory).

The vulnerability has been fixed in multiple PAN-OS versions: 10.1.12, 10.2.7-h3, 10.2.8, 11.0.4, and all later PAN-OS versions. Organizations running affected versions should upgrade their Panorama installations to the patched versions (Palo Security Advisory).