{"id":"CVE-2020-2034","published":"2020-07-08T16:35:17Z","modified":"2024-09-16T19:46:13Z","title":"PAN-OS: OS command injection vulnerability in GlobalProtect portal","vendor":"Palo Alto Networks","product":"PAN-OS","tier":"core","eol":null,"affectedVersions":[{"vendor":"Palo Alto Networks","product":"PAN-OS","versions":["8.0.*","7.1.*",">= 9.1, < 9.1.3",">= 9.0, < 9.0.9",">= 8.1, < 8.1.15"]}],"description":{"text":"An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect portal feature is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; all versions of PAN-OS 8.0 and PAN-OS 7.1. Prisma Access services are not impacted by this vulnerability.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.07152,"percentile":0.94259,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-07-31","exploitedFirstSeen":"2025-07-31","ransomware":false,"evidence":[{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-Early-Warning-Signals-Attacker-Behavior-Precedes-New-Vulnerabilities-Report.pdf","date":"2025-07-31"},{"url":"https://4282754.hs-sites.com/hubfs/resources/GreyNoise-2026-State-of-the-Edge-Report.pdf","date":"2026-02-24"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":3,"pulses":[{"name":"ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.","url":"https://otx.alienvault.com/pulse/69fdc02bea1e4ec923b01688","created":"2026-05-08"},{"name":"SCANID: S-KhOoOrXsco8: Thor Lite Linux 64 - Sample Lab Device 2 - incomplete (not enriched)","url":"https://otx.alienvault.com/pulse/67c6bb5aa601e91b1314ff44","created":"2025-03-04"},{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2020-2034","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-22060","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22060","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2020-08-08","earliestUrl":"https://github.com/blackhatethicalhacking/CVE-2020-2034-POC","repos":[{"name":"blackhatethicalhacking/CVE-2020-2034-POC","url":"https://github.com/blackhatethicalhacking/CVE-2020-2034-POC","stars":12,"created":"2020-08-08"}]},"first":{"date":"2020-08-08","source":"PoC-in-GitHub","url":"https://github.com/blackhatethicalhacking/CVE-2020-2034-POC"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-07-08","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-2034","provenance":"source"},{"date":"2020-08-08","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/blackhatethicalhacking/CVE-2020-2034-POC","provenance":"source"},{"date":"2025-07-31","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://info.greynoise.io/hubfs/resources/GreyNoise-Early-Warning-Signals-Attacker-Behavior-Precedes-New-Vulnerabilities-Report.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":31,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":65.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 455 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.85,"detail":"percentile 0.9426"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-palo-alto-networks-pan-os-cwe-78"}}