CVE-2019-17440 : What You Need to Know

An attacker who has network access to the Log Forwarding Card (LFC) on PA-7000 Series devices with a second-generation Switch Management Card (SMC) may be able to gain root access to PAN-OS if improper communication restrictions are in place. This vulnerability affects PAN-OS 9.0 versions earlier than 9.0.5-h3, specifically on PA-7080 and PA-7050 devices with an LFC installed and configured.

Understanding CVE-2019-17440

This CVE involves an improper restriction of communication to the Log Forwarding Card (LFC) on specific PA-7000 Series devices, potentially allowing unauthorized root access to PAN-OS.

What is CVE-2019-17440?

An attacker with network access to the LFC on PA-7000 Series devices with 2nd Generation SMC may gain root access to PAN-OS due to communication restrictions.
The vulnerability impacts PAN-OS 9.0 versions earlier than 9.0.5-h3 on specific PA-7080 and PA-7050 devices.

The Impact of CVE-2019-17440

CVSS Score: 10 (Critical)
Attack Vector: Network
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
Scope: Changed
Privileges Required: None

Technical Details of CVE-2019-17440

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability allows attackers to gain root access to PAN-OS by exploiting communication restrictions to the LFC on specific PA-7000 Series devices.

Affected Systems and Versions

Affected Systems: PA-7000 Series with 2nd Generation SMC
Affected Versions: PAN-OS 9.0 versions earlier than 9.0.5-h3 on PA-7080 and PA-7050 devices with an LFC

Exploitation Mechanism

Attackers with network access to the LFC can exploit improper communication restrictions to gain root access to PAN-OS.

Mitigation and Prevention

Effective steps to mitigate and prevent exploitation of CVE-2019-17440.

Immediate Steps to Take

Apply content update 8218-5815 or upgrade to PAN-OS version 9.0.5-h3 or later.
Configure security policies to block network sessions to the LFC.
Restrict LFC access to a secured administrative network for trusted users.
Temporarily disable or disconnect the LFC until fixes are applied.

Long-Term Security Practices

Regularly update PAN-OS to the latest fixed versions.
Implement network segmentation and access controls to limit unauthorized access.

Patching and Updates

Ensure all systems are updated to PAN-OS version 9.0.5-h3 or later to address the vulnerability.