Detections
Analytics

Palo Alto Networks PAN-OS 10.1.x / 10.2.x / 11.0.x / 11.1.x / 9.1.x Vulnerability

critical Nessus Plugin ID 344625

Synopsis

The remote PAN-OS host is affected by a vulnerability

Description

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 9.1.x, 10.1.x, 10.2.x, 11.0.x, or 11.1.x. It is, therefore, affected by a vulnerability.

 This vulnerability allows an attacker performing a meddler-in-the-middle attack between Palo Alto Networks PAN-OS firewall and a RADIUS server to bypass authentication and escalate privileges to superuser' when RADIUS authentication is in use and either CHAP or PAP is selected in the RADIUS server profile.

 CHAP and PAP are protocols with no Transport Layer Security (TLS), and hence vulnerable to meddler-in-the- middle attacks. Neither protocol should be used unless they are encapsulated by an encrypted tunnel. If they are in use, but are encapsulated within a TLS tunnel, they are not vulnerable to this attack.

 For additional information regarding this vulnerability, please see https://blastradius.fail.

Tenable has extracted the preceding description block directly from the PAN-OS security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to a fixed version

See Also

https://security.paloaltonetworks.com/CVE-2024-3596

Plugin Details

Severity: Critical

ID: 344625

File Name: palo_alto_CVE-2024-3596.nasl

Version: 1.1

Type: Combined

Published: 9/10/2026

Updated: 9/10/2026

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.8

Percentile: 99.34

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-3596

CVSS v3

Risk Factor: Critical

Base Score: 9

Temporal Score: 7.8

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Threat Score: 7.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:paloaltonetworks:pan-os

Required KB Items: Host/Palo_Alto/Firewall/Version, Host/Palo_Alto/Firewall/Full_Version, Host/Palo_Alto/Firewall/Source, Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 7/10/2024

Vulnerability Publication Date: 7/9/2024

Reference Information

CVE: CVE-2024-3596

CWE: 290