CVE-2021-3048

PAN-OS: Invalid URLs in an External Dynamic List (EDL) can Lead to Firewall Outage

Severity Score

5.9

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This condition causes subsequent commits on the firewall to fail and prevents administrators from performing commits and configuration changes even though the firewall remains otherwise functional. If the firewall then restarts, it results in a denial-of-service (DoS) condition and the firewall stops processing traffic. This issue impacts: PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier than PAN-OS 10.0.5. PAN-OS 8.1 and PAN-OS 10.1 versions are not impacted.

Determinadas entradas de URL no válidas contenidas en una lista dinámica externa (EDL) hacen que el demonio del servidor de dispositivos (devsrvr) deje de responder. Esta situación causa que fallen las confirmaciones posteriores en el firewalls e impide a los administradores llevar a cabo confirmaciones y cambios de configuración, aunque el firewalls siga siendo funcional. Si el firewalls se reinicia, se produce una condición de denegación de servicio (DoS) y el firewalls deja de procesar el tráfico. Este problema afecta a: PAN-OS versiones 9.0 anteriores a PAN-OS 9.0.14; PAN-OS versiones 9.1 anteriores a PAN-OS 9.1.9; PAN-OS versiones 10.0 anteriores a PAN-OS 10.0.5. Versiones PAN-OS 8.1 y PAN-OS 10.1 no están afectadas

*Credits: This issue was encountered by some customers of Palo Alto Networks during regular operation.

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-01-06 CVE Reserved
2021-08-11 CVE Published
2024-04-26 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (2)

URL	Tag	Source
https://security.paloaltonetworks.com/CVE-2020-3048	Broken Link

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://security.paloaltonetworks.com/CVE-2021-3048	2021-08-19

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Paloaltonetworks Search vendor "Paloaltonetworks"		Pan-os Search vendor "Paloaltonetworks" for product "Pan-os"				>= 9.0.0 < 9.0.14 Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 9.0.0 < 9.0.14"		-		Affected
Paloaltonetworks Search vendor "Paloaltonetworks"		Pan-os Search vendor "Paloaltonetworks" for product "Pan-os"				>= 9.1.0 < 9.1.9 Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 9.1.0 < 9.1.9"		-		Affected
Paloaltonetworks Search vendor "Paloaltonetworks"		Pan-os Search vendor "Paloaltonetworks" for product "Pan-os"				>= 10.0.0 < 10.0.5 Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 10.0.0 < 10.0.5"		-		Affected