CVE-2020-2040 - PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled · CoreCVE

Back Back to CVE browser

CRITICAL

PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled

Published Sep 9, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 3.94%

Description

A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.

Affected products

Vendor Palo Alto Networks Product Pan-OS Default
n/a
- Version
  8.0.*
  Status
  affected
  Constraints
  -
- Version
  8.1
  Status
  affected
  Constraints
  <8.1.15
- Version
  9.0
  Status
  affected
  Constraints
  <9.0.9
- Version
  9.1
  Status
  affected
  Constraints
  <9.1.3
- Version
  10.0.0
  Status
  unaffected
  Constraints
  <10.0*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Palo Alto Networks

n/a

Version	Status	Constraints
8.0.*	affected	-
8.1	affected	<8.1.15
9.0	affected	<9.0.9
9.1	affected	<9.1.3
10.0.0	unaffected	<10.0*

Remediation

Vendor solution

This issue is fixed in PAN-OS 8.1.15, PAN-OS 9.0.9, PAN-OS 9.1.3, and all later PAN-OS versions.

All Prisma Access services are now upgraded to resolve this issue and are no longer vulnerable.

PAN-OS 7.1 and 8.0 are end-of-life and are no longer covered by our Product Security Assurance policies.

Weaknesses (1)

CWE-120

Classic Buffer Overflow

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22066
Advisory
https://security.paloaltonetworks.com/CVE-2020-2040
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22066		Advisory
https://security.paloaltonetworks.com/CVE-2020-2040		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner palo_alto

Published Sep 9, 2020

Updated Sep 16, 2024

Reserved Dec 4, 2019

Link CVE-2020-2040

CISA Vulnrichment

Updated n/a

Status Modified

Modified Jun 17, 2026

Link CVE-2020-2040

Severity n/a

Public date n/a

Links CVE-2020-2040

Assigner palo_alto

Published Sep 9, 2020

Updated Sep 16, 2024

Exploited since n/a

Link EUVD-2020-22066

EUVD-2020-22066