CVE-2024-5921

HIGH EPSS 70.2%
Published Nov 27, 20241y ago · Modified Jun 17, 20261w ago
7.1 CVSS 4.0
High
Find Similar
Published Nov 27, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint. Please subscribe to our RSS feed https://security.paloaltonetworks.com/rss.xml to be alerted to new updates to this and other advisories.

CVSS Details

Base Score
7.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
70.2% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-295

Affected Products 7

VendorProductVersionRange
paloaltonetworksglobalprotect*≥6.1.0  –  <6.1.6
paloaltonetworksglobalprotect*≥6.1.0  –  <6.1.7
paloaltonetworksglobalprotect*≥6.1.0  –  <6.2.1
paloaltonetworksglobalprotect*≥6.1.0  –  <6.2.6
paloaltonetworksglobalprotect*≥6.1.0  –  <6.2.6
paloaltonetworksglobalprotect*≥6.3.0  –  <6.3.2
paloaltonetworksglobalprotect*≥6.3.0  –  <6.3.2

References 3

  • blog.amberwolf.com https://blog.amberwolf.com/blog/2024/november/palo-alto-globalprotect---code-execution-and-privilege-escalation-via-malicious-vpn-server-cve-2024-5921/
    ExploitTechnical DescriptionThird Party Advisory
  • github.com https://github.com/AmberWolfCyber/NachoVPN
    Not Applicable
  • security.paloaltonetworks.com https://security.paloaltonetworks.com/CVE-2024-5921
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.