Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2019-17440

10.0 · CRITICAL

Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with network access to the LF…

Published Dec 20, 2019CWE-923EPSS 1.68%

Overview

CVE-2019-17440 is a critical-severity vulnerability. It was published on December 20, 2019 and has a CVSS 3.1 base score of 10.0 (CRITICAL).

This vulnerability has a CVSS 3.1 base score of 10.0, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical description

Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with network access to the LFC to gain root access to PAN-OS. This issue affects PAN-OS 9.0 versions prior to 9.0.5-h3 on PA-7080 and PA-7050 devices with an LFC installed and configured. This issue does not affect PA-7000 Series deployments using the first-generation SMC and the Log Processing Card (LPC). This issue does not affect any other PA series devices. This issue does not affect devices without an LFC. This issue does not affect PAN-OS 8.1 or prior releases. This issue only affected a very limited number of customers and we undertook individual outreach to help them upgrade. At the time of publication, all identified customers have upgraded SW or content and are not impacted.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refsecurity.paloaltonetworks.com/CVE-2019-17440Refsecurity.paloaltonetworks.com/CVE-2019-17440

How CyberStrike helps

Frequently asked questions

What is CVE-2019-17440?

CVE-2019-17440 is a critical-severity vulnerability. It was published on December 20, 2019 and has a CVSS 3.1 base score of 10.0 (CRITICAL).

How severe is CVE-2019-17440?

This vulnerability has a CVSS 3.1 base score of 10.0, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2019-17440?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2019-17440?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2019-17440 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related CRITICAL CVEs from 2019

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999