CVE-2020-1999

12.11.2020, 00:15

A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the network in a way that is not analyzed for threats by sending data through specifically crafted TCP packets. This technique evades signature-based threat detection. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.17; PAN-OS 9.0 versions earlier than 9.0.11; PAN-OS 9.1 versions earlier than 9.1.5; All versions of PAN-OS 7.1 and PAN-OS 8.0.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
palo_alto	CNA	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 30%

Vendor	Product	Version
paloaltonetworks	pan-os	7.1.0 ≤ 𝑥 ≤ 7.1.26
paloaltonetworks	pan-os	8.0.0 ≤ 𝑥 ≤ 8.0.20
paloaltonetworks	pan-os	8.1.0 ≤ 𝑥 < 8.1.17
paloaltonetworks	pan-os	9.0.0 ≤ 𝑥 < 9.0.11
paloaltonetworks	pan-os	9.1.0 ≤ 𝑥 < 9.1.5

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-754 - Improper Check for Unusual or Exceptional Conditions
The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.

References

https://security.paloaltonetworks.com/CVE-2020-1999